750416 - Assertion failure: *vpp <= *endp in restoreValueArray

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: patch

I found this while tryservering the incremental GC code and managed to turn it into a unit test. If the slotspan of an object decreases during marking, and if the slotspan was below the number of fixed slots, then we'll assert. This patch just handles the decrease more carefully.

Comment 1

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: patch with test

Oops. Forgot the test.

Comment 2

[Igor Bukanov]

Comment on attachment 619646 [details] [diff] [review]
patch with test

Review of attachment 619646 [details] [diff] [review]:
-----------------------------------------------------------------

Nice catch!

Comment 3

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ea0c9e5dd1b7

Comment 4

[(no longer active)]

https://hg.mozilla.org/mozilla-central/rev/ea0c9e5dd1b7