952819 - GenerationalGC: Assertion failure: isEnabled(), at gc/StoreBuffer.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

verifypostbarriers()
verifyprebarriers()
verifypostbarriers()

asserts js debug shell on m-c changeset 599100c4ebfe without any CLI arguments at Assertion failure: isEnabled(), at gc/StoreBuffer.cpp

My configure options are:

CC="gcc -m32" AR=ar PKG_CONFIG_LIBDIR=/usr/lib/pkgconfig CXX="g++ -m32" sh ./configure --target=i686-pc-linux --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-exact-rooting --enable-elf-hack --enable-stdcxx-compat --enable-warnings-as-errors --enable-signmar --disable-elf-hack --enable-js-diagnostics --with-intl-api=build --enable-ctypes --disable-shared-js --enable-jemalloc --enable-gcgenerational --with-ccache --enable-threadsafe <other NSPR options>

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/06f844b81f3d
user:        Brian Hackett
date:        Wed Nov 27 16:28:57 2013 -0700
summary:     Bug 938124 - Add classes for use in IonBuilder thread safety analysis, r=jandem.

(not sure if bug 938124 is entirely at fault here)

Comment 1

[Jon Coppeard (:jonco)]

Attachment: bug952819-verify-nesting

The testcase is doing the following:

1. Start verifying post barriers
2. Start verifying pre barriers
3. Finish verifying post barriers

The problem is that pre barrier verification disables GGC, but post barrier verification relies on making use of the store buffer.  I guess this combination is just not going to work.

Here's a patch to disallow starting pre barrier verification while post barrier verification is ongoing.

Comment 2

[Terrence Cole [:terrence]]

Comment on attachment 8355241 [details] [diff] [review]
bug952819-verify-nesting

Review of attachment 8355241 [details] [diff] [review]:
-----------------------------------------------------------------

I agree, there's no reason to ever want to do both at once. r=me

::: js/src/gc/Verifier.cpp
@@ +455,5 @@
>          return;
>  
> +    /*
> +     * The post barrier verifier requires the storebuffer to be enabled, but the
> +     * pre barrier verifier disables it as part of disabling GGC.  Don't allow

One space between sentences.

Comment 3

[Jon Coppeard (:jonco)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/cab31cbee5e6

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/cab31cbee5e6

Comment 5

[Jesse Ruderman]

Should the opposite nesting (post during pre) also be disabled?