Closed Bug 570746 Opened 10 years ago Closed 10 years ago

Assertion failure: rt->emptyArgumentsScope->shape == JSScope::EMPTY_ARGUMENTS_SHAPE, at js/src/jsscope.cpp:289

Categories

(Core :: JavaScript Engine, defect)

Other Branch
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: jorendorff, Assigned: jorendorff)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

This happens during browser startup. I think I know what the problem is. Patch with jsapi-test coming.
BEGIN_TEST(testContexts_bug570764)
{
    JSRuntime *rt2 = JS_NewRuntime(8L * 1024 * 1024);
    CHECK(rt2);

    // Create and destroy first context.
    JSContext *cx2 = JS_NewContext(rt2, 8192);
    CHECK(cx2);
    JS_BeginRequest(cx2);
    JSObject *obj = JS_NewGlobalObject(cx2, getGlobalClass());
    CHECK(obj);
    jsvalRoot objr(cx2, OBJECT_TO_JSVAL(obj));
    JS_DestroyContext(cx2);

    // Create and destroy second context.
    cx2 = JS_NewContext(rt2, 8192);
    CHECK(cx2);
    JS_DestroyContext(cx2);

    JS_DestroyRuntime(rt2);
}
END_TEST(testContexts_bug570764)
Attached patch v1Splinter Review
Assignee: general → jorendorff
Attachment #449895 - Flags: review?(brendan)
Attachment #449895 - Flags: review?(brendan) → review+
http://hg.mozilla.org/tracemonkey/rev/d12f72c640fe
Whiteboard: fixed-in-tracemonkey
http://hg.mozilla.org/mozilla-central/rev/d12f72c640fe
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.