Closed
Bug 865632
Opened 12 years ago
Closed 12 years ago
Assertion failure: [barrier verifier] Unmarked edge: objectElements, at gc/Verifier.cpp:612
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 865626
People
(Reporter: decoder, Unassigned)
Details
(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update])
The following testcase asserts on mozilla-central revision 690b5e0f6562 (run with --ion-eager):
gczeal(4);
function testScatter() {
var shape = [5];
for (var i = 0; i < 7; i++) {
shape.push(32);
var p = new ParallelArray(shape, function(k) { return k; });
var r = p.scatter([0,1,0,3,4], 9, function (a,b) {}, 10);
}
}
testScatter();
|
Reporter | |
Comment 1•12 years ago
|
||
S-s due to GC related assertion.
Whiteboard: [jsbugmon:update,bisect]
|
|
Reporter | |
Updated•12 years ago
|
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
|
|
Reporter | |
Comment 2•12 years ago
|
||
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
changeset: 125555:b00eb1ef1517
user: Nicholas D. Matsakis
date: Tue Mar 19 22:12:27 2013 -0400
summary: Bug 829602 - Enable self-hosted parallelarray r=dvander,till
This iteration took 14.807 seconds to run.
|
||
Comment 3•12 years ago
|
||
How was the shell compiled? I can't reproduce locally on 690b5e0f6562 with --enable-threadsafe --enable-debug --disable-optimize.
|
|
||
Comment 4•12 years ago
|
||
Nevermind, I can reproduce without --enable-threadsafe.
|
|
||
Comment 5•12 years ago
|
||
Caused by not having correct type information when inlining UnsafeSetElement, causing a pre-barrier to not be emitted. Fixed by 865626.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
|
||
Updated•9 years ago
|
Group: core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•