The following testcase asserts on mozilla-central built with --enable-exact-rooting --enable-gcgenerational, revision 3dd1dc64123a (run with --fuzzing-safe): function callback(obj) {} setObjectMetadataCallback(callback); gczeal(7); var statusitems = [];

This problem is related to the fact that setObjectMetadataCallback() disables GGC, which was the fix for bug 929151. Nursery::enterZealMode() currently sets numActiveChunks_, which will cause isEnabled() to return true, even if the nursery was disabled before. The patch checks makes enterZealMode() check whether we are enabled before changing this, and also makes sure enterZealMode() gets called again when the nursery is re-enabled.

Comment on attachment 827466 [details] [diff] [review] bug935022-metadata-fuzz Review of attachment 827466 [details] [diff] [review]: ----------------------------------------------------------------- D'oh! I missed an edge case. :-( r=me And thanks for giving us more fuzzing time, Christian! ::: js/src/gc/Nursery.cpp @@ +98,5 @@ > > void * > js::Nursery::allocate(size_t size) > { > + JS_ASSERT(isEnabled()); Nice!

(In reply to Jon Coppeard (:jonco) from comment #1) > The patch checks makes enterZealMode() check whether we are enabled before > changing this, and also makes sure enterZealMode() gets called again when > the nursery is re-enabled. I didn't see the latter? Or maybe I'm not understanding. I thought this meant that if you set a metadata callback, called enterZealMode (which would not take effect), and then cleared the metadata callback, that you'd automatically make enterZealMode() take effect? Or did you just mean that clearing the metadata callback would allow future enterZealMode()s work?

(In reply to Steve Fink [:sfink] from comment #3) > (In reply to Jon Coppeard (:jonco) from comment #1) > > The patch checks makes enterZealMode() check whether we are enabled before > > changing this, and also makes sure enterZealMode() gets called again when > > the nursery is re-enabled. > > I didn't see the latter? Or maybe I'm not understanding. I thought this > meant that if you set a metadata callback, called enterZealMode (which would > not take effect), and then cleared the metadata callback, that you'd > automatically make enterZealMode() take effect? Or did you just mean that > clearing the metadata callback would allow future enterZealMode()s work? This only fixes the nursery: I think the metadata callback still perma-disables the nursery.