"Assertion failure: !fp->dormantNext"

RESOLVED FIXED

Status

()

defect
--
critical
RESOLVED FIXED
12 years ago
10 years ago

People

(Reporter: jruderman, Assigned: mrbkap)

Tracking

(Blocks 1 bug, {assertion})

Trunk
x86
macOS
Points:
---
Dependency tree / graph
Bug Flags:
wanted1.8.1.x +
in-testsuite -

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

12 years ago
Assertion failure: !fp->dormantNext, at /Users/jruderman/trunk/mozilla/js/src/jsapi.c:4921

or

Assertion failure: !chain->dormantNext, at /Users/jruderman/trunk/mozilla/js/src/jsgc.c:2432

I wasn't able to make a nice testcase because the bug depends on cycle collection timing, but mrbkap figured out the bug after I trapped it in the debugger, and I think he has a patch.
Posted patch Proposed fixSplinter Review
I think that this is just at simple oversight on Igor's part: he always sets acx->fp->dormantNext, but only unsets it if we're a marking tracer, which isn't always the case.
Assignee: general → mrbkap
Status: NEW → ASSIGNED
Attachment #271904 - Flags: review?(igor)

Comment 2

12 years ago
Comment on attachment 271904 [details] [diff] [review]
Proposed fix

Yep, the code must always undo dormantNext.
Attachment #271904 - Flags: review?(igor) → review+
Fix checked into trunk.
Status: ASSIGNED → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → FIXED
Duplicate of this bug: 387187

Updated

12 years ago
Flags: in-testsuite-
Flags: wanted1.8.1.x+
You need to log in before you can comment on or make changes to this bug.