Closed
Bug 708805
Opened 13 years ago
Closed 13 years ago
Assertion failure: static_cast<Cell *>(thing)->isMarked(), at jsgc.cpp:3529
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla11
People
(Reporter: decoder, Assigned: billm)
Details
(Keywords: assertion, testcase)
Attachments
(1 file)
3.54 KB,
patch
|
bhackett1024
:
review+
|
Details | Diff | Splinter Review |
The following test asserts on mozilla-central revision 6785d3003414 (options -m -n -a): gczeal(4); test(); function test() eval("with({}) let(x=[])(function(){#2=x})()"); Not s-s due to incremental GC relatedness.
Assignee | ||
Comment 1•13 years ago
|
||
Another great test. I'm not sure how I missed this barrier.
Attachment #580282 -
Flags: review?(bhackett1024)
Comment 2•13 years ago
|
||
This field didn't exist before objshrink. I must be missing something, as I didn't think that incremental barriers were needed at all for fields that are only written at the point of object creation (as the function's environment is). I can see how the HeapPtr is needed for generational write barriers though, are the gczeal(4) asserts stronger than is required for incremental GC?
Assignee | ||
Comment 3•13 years ago
|
||
(In reply to Brian Hackett (:bhackett) from comment #2) > I must be missing something, as I > didn't think that incremental barriers were needed at all for fields that > are only written at the point of object creation (as the function's > environment is). There is a write in CloneFunctionObjectIfNotSingleton that is on a pre-existing object. The verifier currently checks only what's needed for incremental GC. Terrence is working on checks for generational.
Updated•13 years ago
|
Attachment #580282 -
Flags: review?(bhackett1024) → review+
Assignee | ||
Comment 4•13 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/3a190f6b9ee3
Target Milestone: --- → mozilla11
Comment 5•13 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/3a190f6b9ee3
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Reporter | ||
Comment 6•11 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug708805.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•