Last Comment Bug 658209 - TI+JM: Assertion failure: !cx->compartment->activeAnalysis, at jsinterp.cpp:624
: TI+JM: Assertion failure: !cx->compartment->activeAnalysis, at jsinterp.cpp:624
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: general
:
Mentors:
Depends on:
Blocks: infer-regress
  Show dependency treegraph
 
Reported: 2011-05-19 02:20 PDT by Jan de Mooij [:jandem] (PTO until July 31)
Modified: 2011-05-19 16:17 PDT (History)
3 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Jan de Mooij [:jandem] (PTO until July 31) 2011-05-19 02:20:54 PDT
--
for (var i=0; i<20; i++) {
    (function () {
        var x;
        (function () {
            x = /abc/;
            x++;
            gc();
        })();
    })();
}
--
$ ./js -m -n test.js
Assertion failure: !cx->compartment->activeAnalysis, at jsinterp.cpp:624

Revision 4dff743ec04d, 32-bit OS X.
Comment 1 Brian Hackett (:bhackett) 2011-05-19 16:17:02 PDT
Good, new assertion which caught a bug introduced with the interpoline.  We should never reenter the interpreter or JIT code while analysis is active (recompilation will not happen until analysis finishes, and no scripts or type objects can be collected by GC), but this was possible while finishing up an operation if we rejoined into the middle of an INC/DEC op.

http://hg.mozilla.org/projects/jaegermonkey/rev/47e5a6ca466e

Note You need to log in before you can comment on or make changes to this bug.