Closed Bug 975947 Opened 6 years ago Closed 6 years ago

GenerationalGC: Assertion failure: owner->isEnabled(), at gc/StoreBuffer.cpp

Categories

(Core :: JavaScript: GC, defect, critical)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla30

People

(Reporter: gkw, Assigned: terrence)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])

Attachments

(2 files, 1 obsolete file)

Attached file stack
The upcoming testcase asserts js debug shell (tested with a threadsafe deterministic 32-bit debug build) on m-c changeset 1238ef12b996 without any CLI arguments at Assertion failure: owner->isEnabled(), at gc/StoreBuffer.cpp

My configure options are:

CC="gcc -m32" AR=ar PKG_CONFIG_LIBDIR=/usr/lib/pkgconfig CXX="g++ -m32" sh ./configure --target=i686-pc-linux --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-exact-rooting --enable-gcgenerational --with-ccache --enable-threadsafe <other NSPR options>

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/78a029898775
user:        Jon Coppeard
date:        Fri Feb 07 11:20:38 2014 +0000
summary:     Bug 961091 - Perform GC if necessary on exit from engine and on interpreter allocation r=terrence
Flags: needinfo?(jcoppeard)
Assignee: nobody → terrence
The state management around GGC enable/disable and post-barrier verification has been a nightmare basically forever. This cuts the problem off at the knees by removing the non-stacky entry points for GGC toggling and making the toggling functions aware of the verifier.
Attachment #8380781 - Flags: review?(sphink)
Flags: needinfo?(jcoppeard)
And with qreffing.
Attachment #8380781 - Attachment is obsolete: true
Attachment #8380781 - Flags: review?(sphink)
Attachment #8380784 - Flags: review?(sphink)
Comment on attachment 8380784 [details] [diff] [review]
prevent_further_disabling_errors-v1.diff

Review of attachment 8380784 [details] [diff] [review]:
-----------------------------------------------------------------

Definitely seems safer. I didn't realize that all uses were RAII-scopable, though. What happened to the SetObjectMetadataCallback one?
Attachment #8380784 - Flags: review?(sphink) → review+
Whiteboard: [jsbugmon:update]
Jon fixed the initial shapes table marking so that we can allow the relevant objects to be in the nursery now. As far as grep can tell, there are no more uses of the non-stacky version.
Depends on: 976750
https://hg.mozilla.org/mozilla-central/rev/a278b0807420
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla30
You need to log in before you can comment on or make changes to this bug.