975947 - GenerationalGC: Assertion failure: owner->isEnabled(), at gc/StoreBuffer.cpp

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

The upcoming testcase asserts js debug shell (tested with a threadsafe deterministic 32-bit debug build) on m-c changeset 1238ef12b996 without any CLI arguments at Assertion failure: owner->isEnabled(), at gc/StoreBuffer.cpp

My configure options are:

CC="gcc -m32" AR=ar PKG_CONFIG_LIBDIR=/usr/lib/pkgconfig CXX="g++ -m32" sh ./configure --target=i686-pc-linux --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-exact-rooting --enable-gcgenerational --with-ccache --enable-threadsafe <other NSPR options>

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/78a029898775
user:        Jon Coppeard
date:        Fri Feb 07 11:20:38 2014 +0000
summary:     Bug 961091 - Perform GC if necessary on exit from engine and on interpreter allocation r=terrence

Comment 2

[Terrence Cole [:terrence]]

Attachment: prevent_further_disabling_errors-v0.diff

The state management around GGC enable/disable and post-barrier verification has been a nightmare basically forever. This cuts the problem off at the knees by removing the non-stacky entry points for GGC toggling and making the toggling functions aware of the verifier.

Comment 3

[Terrence Cole [:terrence]]

Attachment: prevent_further_disabling_errors-v1.diff

And with qreffing.

Comment 4

[Steve Fink [:sfink] [:s:]]

Comment on attachment 8380784 [details] [diff] [review]
prevent_further_disabling_errors-v1.diff

Review of attachment 8380784 [details] [diff] [review]:
-----------------------------------------------------------------

Definitely seems safer. I didn't realize that all uses were RAII-scopable, though. What happened to the SetObjectMetadataCallback one?

Comment 5

[Terrence Cole [:terrence]]

Jon fixed the initial shapes table marking so that we can allow the relevant objects to be in the nursery now. As far as grep can tell, there are no more uses of the non-stacky version.

Comment 6

[Terrence Cole [:terrence]]

The failures are all maple specific, so I think this is working fine:
https://tbpl.mozilla.org/?tree=Try&rev=c9f2b4898474

https://hg.mozilla.org/integration/mozilla-inbound/rev/a278b0807420

Comment 7

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/a278b0807420