582880 - JM: "Assertion failure: !(addr & GC_CELL_MASK),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

x = <x/>
default xml namespace = [];
(function () {
    function a() {}
    a([7].some(gc))
}())

asserts js debug shell on JM changeset 3700c42a8e82 with -m at Assertion failure: !(addr & GC_CELL_MASK), at ../jsgc.cpp:412

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Okay, last straw. The problem here is that we want to avoid syncing copies of local variables, which was definitely a big performance win (I think somewhere from 4-6%, all said and done). But we don't initialize fp->slots() being script->nfixed, so there can just be garbage there.

Time to use conservative GC rather than regress this.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Gary - these gc bugs are great. Keep 'em coming :)

Comment 3

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug582880.js.