"Assertion failure: !fp->dormantNext"

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
11 years ago
9 years ago

People

(Reporter: Jesse Ruderman, Assigned: mrbkap)

Tracking

(Blocks: 1 bug, {assertion})

Trunk
x86
Mac OS X
assertion
Points:
---
Dependency tree / graph
Bug Flags:
wanted1.8.1.x +
in-testsuite -

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

11 years ago
Assertion failure: !fp->dormantNext, at /Users/jruderman/trunk/mozilla/js/src/jsapi.c:4921

or

Assertion failure: !chain->dormantNext, at /Users/jruderman/trunk/mozilla/js/src/jsgc.c:2432

I wasn't able to make a nice testcase because the bug depends on cycle collection timing, but mrbkap figured out the bug after I trapped it in the debugger, and I think he has a patch.
(Assignee)

Comment 1

11 years ago
Created attachment 271904 [details] [diff] [review]
Proposed fix

I think that this is just at simple oversight on Igor's part: he always sets acx->fp->dormantNext, but only unsets it if we're a marking tracer, which isn't always the case.
Assignee: general → mrbkap
Status: NEW → ASSIGNED
Attachment #271904 - Flags: review?(igor)

Comment 2

11 years ago
Comment on attachment 271904 [details] [diff] [review]
Proposed fix

Yep, the code must always undo dormantNext.
Attachment #271904 - Flags: review?(igor) → review+
(Assignee)

Comment 3

11 years ago
Fix checked into trunk.
Status: ASSIGNED → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → FIXED
(Assignee)

Updated

11 years ago
Duplicate of this bug: 387187

Updated

11 years ago
Flags: in-testsuite-
Flags: wanted1.8.1.x+
You need to log in before you can comment on or make changes to this bug.