Closed Bug 673792 Opened 8 years ago Closed 8 years ago

TI: "Assertion failure: thing->compartment() == gcmarker->context->runtime->gcCurrentCompartment,"

Categories

(Core :: JavaScript Engine, defect, critical)

x86
Windows 7
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase)

a = {}.__proto__
gc(evalcx('split'))

asserts js debug shell on JM changeset 8c7adf094b8e without any CLI arguments at Assertion failure: thing->compartment() == gcmarker->context->runtime->gcCurrentCompartment,

This was found using a combination of jsfunfuzz and jandem's method fuzzer.
There was no compartment check when tracing type objects found by the conservative stack scanner, so we could end up marking objects from the wrong compartment during a per-compartment GC.

http://hg.mozilla.org/projects/jaegermonkey/rev/681d2903edb7
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.