708800 - [IncrementalGC] Assertion failure: IsMarkedOrAllocated(static_cast<Cell *>(thing)), at jsgc.cpp:4176

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test asserts on larch branch (incremental GC) revision 1827c8a8a25c (options -m -n -a):


gczeal(4);
var gTestcases = new Array();
var gTc = gTestcases.length;
function TestCase( d, e, a) {
  this.description = d;
  gTestcases[gTc++] = this;
TestCase.prototype.dump = function () {
    dump('\njstest: ' + this.path + ' ' +
         'description: ' + toPrinted(this.description) + ' ' +
         'reason: '      + toPrinted(this.reason) + '\n');
};
}
function toPrinted(value) {
    value = String(value);
  value = value.replace(/\\n/g, 'NL')
               .replace(/\n/g, 'NL')
}
function reportCompare (expected, actual, description) {
  var testcase = new TestCase( description, null);
  dump = function() {};
  for (var i = 0; i < gTestcases.length; i++) gTestcases[i].dump();
}
var actual = 'No Crash';
var expect = 'No Crash';
test();
function test()
  reportCompare(expect, actual, (function  (  )  {  }  )     );
var addexp = 0;
for ( addpow = 0; addpow < 33; addpow++ ) {
  new TestCase(  addexp );
}
test();
for (var i = 0; i < gTestcases.length; i++)  gTestcases[i].dump();

Comment 1

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

https://hg.mozilla.org/projects/larch/rev/341396ef32a8