BaselineCompiler: Assertion failure: [barrier verifier] Unmarked edge: baseline-stub-ioncode, at gc/Verifier.cpp:578

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
major
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Assigned: jandem)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Other Branch
x86
Linux
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
The following testcase asserts on baseline compiler branch revision 1c8552cc6ec4 (run with ):


function TestCase(n, d, e, a)
  this.passed = getTestCaseResult(e, a);
function getTestCaseResult(expected, actual) {
  if (actual != actual)
    return gTestcases;
}
gczeal(4);
var TEST_STRING = new String("");
new TestCase(null, 0,eval("x = new Boolean(true); x.charCodeAt=String.prototype.charCodeAt;x.charCodeAt(0)") );
new TestCase(null, null, 0, eval("x.charCodeAt=String.prototype.charCodeAt;x.charCodeAt(1)"));
new TestCase(null, null, 0, eval("x.charCodeAt=String.prototype.charCodeAt;x.charCodeAt(2)"));
new TestCase(null, null, 0, eval("x.charCodeAt=String.prototype.charCodeAt;x.charCodeAt(3)"));
new TestCase(null, null, Number.NaN, eval("x.charCodeAt=String.prototype.charCodeAt;x.charCodeAt(4)"));
new new let (r) (function () {}) ();
(Assignee)

Comment 1

5 years ago
Created attachment 716015 [details] [diff] [review]
Patch

When we unlink stubs, we have to trace them if incremental gc is active.
Assignee: general → jdemooij
Status: NEW → ASSIGNED
Attachment #716015 - Flags: review?(bhackett1024)
Attachment #716015 - Flags: review?(bhackett1024) → review+
(Assignee)

Comment 2

5 years ago
https://hg.mozilla.org/projects/ionmonkey/rev/a3e644aa7434
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.