Assertion failure: !fp->dormantNext, at /Users/jruderman/trunk/mozilla/js/src/jsapi.c:4921 or Assertion failure: !chain->dormantNext, at /Users/jruderman/trunk/mozilla/js/src/jsgc.c:2432 I wasn't able to make a nice testcase because the bug depends on cycle collection timing, but mrbkap figured out the bug after I trapped it in the debugger, and I think he has a patch.
Created attachment 271904 [details] [diff] [review] Proposed fix I think that this is just at simple oversight on Igor's part: he always sets acx->fp->dormantNext, but only unsets it if we're a marking tracer, which isn't always the case.
Assignee: general → mrbkap
Status: NEW → ASSIGNED
Attachment #271904 - Flags: review?(igor)
Comment on attachment 271904 [details] [diff] [review] Proposed fix Yep, the code must always undo dormantNext.
Attachment #271904 - Flags: review?(igor) → review+
Fix checked into trunk.
Status: ASSIGNED → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.