706997 - [IncrementalGC] "Assertion failure: static_cast<T *>(t)->arenaHeader()->allocatedDuringIncremental,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

for (e in (function() {
  ArrayBuffer(662240797)
})()) {}
newGlobal("new-compartment")

asserts js debug shell on larch changeset 370cedaf963f without any CLI arguments at Assertion failure: static_cast<T *>(t)->arenaHeader()->allocatedDuringIncremental,

Comment 1

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

For some reason I can't reproduce this. I'm using the right changeset, and I have a 32-bit Linux build. I suspect the problem may be fixed by this commit:
  https://hg.mozilla.org/projects/larch/rev/517ef660fb04
Could you check, Gary?

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Bill McCloskey (:billm) from comment #1)
> For some reason I can't reproduce this. I'm using the right changeset, and I
> have a 32-bit Linux build. I suspect the problem may be fixed by this commit:
>   https://hg.mozilla.org/projects/larch/rev/517ef660fb04
> Could you check, Gary?

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   81481:517ef660fb04
user:        Bill McCloskey
date:        Tue Dec 06 16:00:58 2011 -0800
summary:     [INCREMENTAL] Enable barriers when new compartment created during incremental GC

Yes, that's correct!