Closed
Bug 387725
Opened 17 years ago
Closed 17 years ago
"Assertion failure: !fp->dormantNext"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: jruderman, Assigned: mrbkap)
References
Details
(Keywords: assertion)
Attachments
(1 file)
|
1.34 KB,
patch
|
igor
:
review+
|
Details | Diff | Splinter Review |
Assertion failure: !fp->dormantNext, at /Users/jruderman/trunk/mozilla/js/src/jsapi.c:4921
or
Assertion failure: !chain->dormantNext, at /Users/jruderman/trunk/mozilla/js/src/jsgc.c:2432
I wasn't able to make a nice testcase because the bug depends on cycle collection timing, but mrbkap figured out the bug after I trapped it in the debugger, and I think he has a patch.
|
Assignee | |
Comment 1•17 years ago
|
||
I think that this is just at simple oversight on Igor's part: he always sets acx->fp->dormantNext, but only unsets it if we're a marking tracer, which isn't always the case.
|
||
Comment 2•17 years ago
|
||
Comment on attachment 271904 [details] [diff] [review]
Proposed fix
Yep, the code must always undo dormantNext.
Attachment #271904 -
Flags: review?(igor) → review+
|
|
Assignee | |
Comment 3•17 years ago
|
||
Fix checked into trunk.
Status: ASSIGNED → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
|
||
Updated•17 years ago
|
Flags: in-testsuite-
|
||
Updated•16 years ago
|
Flags: wanted1.8.1.x+
You need to log in
before you can comment on or make changes to this bug.
Description
•