870182 - Assertion failure: [barrier verifier] Unmarked edge: method, at gc/Verifier.cpp:614

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision e19d0885977c (run with --ion-eager):


evaluate("\
gcparam(\"maxBytes\", gcparam(\"gcBytes\") + 4*(1));\
gczeal(4);\
(function _2(... b) {})('', ConvertToString.call(Boolean, Boolean.prototype.valueOf()));\
function ConvertToString(obj) {}\
");

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Till Schneidereit [:till]]

Further-reduced version of the destcase in comment 0:

gcparam("maxBytes", gcparam("gcBytes") + 1);
gczeal(4);
function foo(...b) {};
function bar() {};
foo(bar());


Doesn't crash anymore when I remove the rest arg from foo, or don't have a function invocation as the arg (although storing the result of `bar()` into a var and passing that into `foo()` still crashes).

@shu: given that this only happens with --ion-eager, it might be related to bug 867471. OTOH, decoder says that he has a less-reduced testcase without rest-usage that also causes the crash. Only on 32bit, optimized, though, whereas this crashes on 64bit, debug, for me, too.

Comment 3

[Till Schneidereit [:till]]

Don't know if it also reproduces on 32bit, but it certainly does under OS X.

Comment 4

[Shu-yu Guo [:shu]]

I can't reproduce an assert on either test case on 64bit, debug or opt with --enable-root-analysis on my current tip (133304:f0311781c218)

Comment 5

[Christian Holler (:decoder)]

This is not with root-analysis :) The first test should work with --enable-debug --enable-optimize --enable-valgrind.

Comment 6

[Shu-yu Guo [:shu]]

(In reply to Christian Holler (:decoder) from comment #5)
> This is not with root-analysis :) The first test should work with
> --enable-debug --enable-optimize --enable-valgrind.

Ah, okay.

Till, I can't reproduce on current tip. I can reproduce on e19d0885977c, but I don't really see anything related to compiling rest args. For that matter, those patches were pushed on May 21st, this reproduces on a tree from May 8th.

Comment 7

[Jan de Mooij [:jandem]]

3 years old, test WFM with various JIT flags. Please file a new bug if this still shows up!