var x (function() { x }()); verifyprebarriers(); x = x * 0 x = Symbol(); gc(); evalcx("x=1", this); asserts js debug shell on m-c changeset d7e78f0c1465 with --ion-offthread-compile=off --ion-eager --no-threads at Assertion failure: [barrier verifier] Unmarked edge: <unknown>, at gc/Verifier.cpp My configure flags are: CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-nspr-build autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: https://hg.mozilla.org/mozilla-central/rev/82afa573b285 user: Jason Orendorff date: Mon Jun 23 10:56:49 2014 -0500 summary: Bug 645416, part 9 - Implement the symbol registry and Symbol.for(). r=terrence,r=efaust. Setting s-s and assuming sec-critical because this involves gc. Jason, is bug 645416 a likely regressor?

For now, Symbols are nightly-only.

Switching flags to disabled. (plus Symbols only landed and in disabled form from Fx33)

Actually just about every hunk of this patch is there for a different reason, but I think it should be pretty self-explanatory.

Comment on attachment 8489529 [details] [diff] [review] Insert GC pre-barriers for slots containing symbols in Ion code Review of attachment 8489529 [details] [diff] [review]: ----------------------------------------------------------------- Nice!

JSBugMon: This bug has been automatically verified fixed.