Assertion failure: [barrier verifier] Unmarked edge: objectElements, at gc/Verifier.cpp:612

RESOLVED DUPLICATE of bug 865626

Status

()

Core
JavaScript Engine
--
critical
RESOLVED DUPLICATE of bug 865626
5 years ago
3 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
x86
Linux
assertion, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update])

(Reporter)

Description

5 years ago
The following testcase asserts on mozilla-central revision 690b5e0f6562 (run with --ion-eager):


gczeal(4);
function testScatter() {
  var shape = [5];
  for (var i = 0; i < 7; i++) {
    shape.push(32);
    var p = new ParallelArray(shape, function(k) { return k; });
    var r = p.scatter([0,1,0,3,4], 9, function (a,b) {}, 10);
  }
}
testScatter();
(Reporter)

Comment 1

5 years ago
S-s due to GC related assertion.
Whiteboard: [jsbugmon:update,bisect]
(Reporter)

Updated

5 years ago
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
(Reporter)

Comment 2

5 years ago
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   125555:b00eb1ef1517
user:        Nicholas D. Matsakis
date:        Tue Mar 19 22:12:27 2013 -0400
summary:     Bug 829602 - Enable self-hosted parallelarray r=dvander,till

This iteration took 14.807 seconds to run.

Comment 3

5 years ago
How was the shell compiled? I can't reproduce locally on 690b5e0f6562 with --enable-threadsafe --enable-debug --disable-optimize.

Comment 4

5 years ago
Nevermind, I can reproduce without --enable-threadsafe.

Comment 5

5 years ago
Caused by not having correct type information when inlining UnsafeSetElement, causing a pre-barrier to not be emitted. Fixed by 865626.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 865626
Group: core-security
You need to log in before you can comment on or make changes to this bug.