Closed
Bug 890048
Opened 11 years ago
Closed 11 years ago
GenerationalGC: Assertion failure: p, at shell/jsheaptools.cpp
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla25
People
(Reporter: gkw, Assigned: terrence)
References
Details
(Keywords: assertion, testcase)
Attachments
(3 files)
(deleted),
text/plain
|
Details | |
(deleted),
patch
|
billm
:
review+
|
Details | Diff | Splinter Review |
(deleted),
patch
|
jimb
:
review+
|
Details | Diff | Splinter Review |
findReferences([schedulegc(1)])
asserts js debug shell (tested with a threadsafe deterministic 64-bit debug build) on m-c changeset 85d75ed04851 without any CLI arguments at Assertion failure: p, at shell/jsheaptools.cpp
Flags: needinfo?(terrence)
Assignee | ||
Comment 1•11 years ago
|
||
FindReferences doesn't make much sense if the addresses are not stable. This patch fixes and adds api to enable and disable ggc at runtime programatically. The next patch in the series uses these to switch GGC off when we enter a HeapReverser and fixes the rooting of the objects HeapReverser stores.
Assignee: general → terrence
Status: NEW → ASSIGNED
Attachment #772385 -
Flags: review?(wmccloskey)
Flags: needinfo?(terrence)
Assignee | ||
Comment 2•11 years ago
|
||
In particular the use of |roots| seems wrong: it only tracks objects, but the cells in |map| and the Node lists can be any type. The attached patch rips out all the indirect rooting and just uses CustomAutoRooter's callback to manually mark everything. I think it's a bit more code overall, but much less cognitive overhead than the current scheme.
Attachment #772388 -
Flags: review?(jimb)
Attachment #772385 -
Flags: review?(wmccloskey) → review+
Comment 3•11 years ago
|
||
Comment on attachment 772388 [details] [diff] [review]
Part 2 of 2 - Fix HeapReverser for GGC.
Review of attachment 772388 [details] [diff] [review]:
-----------------------------------------------------------------
Thank you so much.
::: js/src/shell/jsheaptools.cpp
@@ -165,5 @@
> - * rule. This is kind of dumb, but JSAPI doesn't provide any less restricted
> - * way to register arrays of roots.
> - */
> - Vector<jsval, 0, SystemAllocPolicy> roots;
> - AutoArrayRooter rooter;
I love it.
@@ +245,5 @@
> + e.front().value.trace(trc);
> + }
> + for (Child *c = work.begin(); c != work.end(); ++c)
> + JS_CallGenericTracer(trc, c->cell, "HeapReverser::Child");
> + }
Much nicer.
Attachment #772388 -
Flags: review?(jimb) → review+
Assignee | ||
Comment 4•11 years ago
|
||
Comment 5•11 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla25
You need to log in
before you can comment on or make changes to this bug.
Description
•