886560 - GenerationalGC: Assertion failure: !IsInsideNursery(thing->runtime(), thing), at gc/Marking.cpp:729

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central built with --enable-exact-rooting --enable-gcgenerational, revision 76820c6dff7b (run with --fuzzing-safe):


setObjectMetadataCallback(function(obj) {
    var res = {};
    return res;
  });
gczeal(4);
x();

Comment 1

[Terrence Cole [:terrence]]

Attachment: v0

PushMarkStack for BaseShape unpacks its children directly onto the mark stack. For a pre-barrier between incremental slices, this may result in objects in the nursery getting pushed onto the mark stack. It is safe to ignore these objects because they will be marked by the matching post-barrier during the minor GC at the start of each incremental slice.

PushMarkStack(JSObject*) is incredibly hot during mark-and-sweep, so I split out a separate function that loosens the assertion and does the extra IsInRuntime check only for the relevant objects. The [Lazy]Script cases do not have this problem because they call MarkChildren, which calls MarkObject, which calls MarkInternal, which already excludes nursery items.

Comment 2

[Terrence Cole [:terrence]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f203d20f1096

Comment 3

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/f203d20f1096