Closed Bug 582880 Opened 12 years ago Closed 12 years ago

JM: "Assertion failure: !(addr & GC_CELL_MASK),"

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: assertion, regression, testcase)

x = <x/>
default xml namespace = [];
(function () {
    function a() {}
    a([7].some(gc))
}())

asserts js debug shell on JM changeset 3700c42a8e82 with -m at Assertion failure: !(addr & GC_CELL_MASK), at ../jsgc.cpp:412
Okay, last straw. The problem here is that we want to avoid syncing copies of local variables, which was definitely a big performance win (I think somewhere from 4-6%, all said and done). But we don't initialize fp->slots() being script->nfixed, so there can just be garbage there.

Time to use conservative GC rather than regress this.
Depends on: 583084
Gary - these gc bugs are great. Keep 'em coming :)
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug582880.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.