893747 - Assertion failure: [barrier verifier] Unmarked edge: objectElements, at gc/Verifier.cpp:572

Status: RESOLVED DUPLICATE of bug 926512

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 18467a85acf6 (threadsafe build, run with --fuzzing-safe):


gczeal(4);
testScan(new Array(1024), function() { return {}; });
function testScan(jsarray, func) {
  var parray = new ParallelArray(jsarray);
  for(var i = 0; i < 10; ++i)
    (function(m) { parray.scan(func, m); })();
}

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

S-s because this is GC related.

Comment 3

[Shu-yu Guo [:shu]]

I cannot reproduce this on a threadsafe shell with --fuzzing-safe on rev 18467a85acf6.

Comment 4

[Christian Holler (:decoder)]

What are your build flags? This seems to be 32 bit.

Comment 5

[Shu-yu Guo [:shu]]

Is this intermittent? I can't reproduce on 32bits either. My flags:

CFLAGS="-m32" CXXFLAGS="-m32" CC=clang CXX=clang++ ../configure --enable-debug --disable-optimize --enable-threadsafe --with-system-nspr --with-ccache --disable-intl-api --target=i686-pc-linux

Comment 6

[Christian Holler (:decoder)]

It reproduces consistently for me. Can you try with --enable-optimize? (All my builds are optimized, debug also). Also I'm using gcc, not sure if it matters here.

Comment 7

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 8

[Christian Holler (:decoder)]

Manually confirmed this, still reproduces (revision 211337f7fb83).

Comment 9

[Jan de Mooij [:jandem]]

Shu, can you take this bug? :)

Comment 10

[Shu-yu Guo [:shu]]

Duplicate of bug 926512, caused by the same thing: needsBarrier being set due to barrier verification on entering a fork join section.

Comment 11

[Shu-yu Guo [:shu]]

Bug can be opened; see comment 10.