Assertion failure: freeLists[kind].isEmpty(), at /home/njn/moz/mi6/js/src/jsgc.h:1081
Aborted (core dumped)
I'm guessing this is related to bug 674251.
I should say that removing mjitstats() from the shell would be an acceptable fix for this, IMHO, because I doubt anyone uses it.
But it would be good to know what the real problem is and if it could have other bad effects.
Created attachment 558460 [details] [diff] [review]
In the bug 674251 I have used too strict assert in the gc::CellIter. The ieterator should allow for non-empty free lists synchronized with the arenas during the GC to support pseudo-GC sessions like one setup for cell enumeration.
This patch fixes that and also fixes another regression from bug 674251 where I wrongfully used gc::FINALIZE_TYPE_OBJECT, not gc::FINALIZE_SCRIPT, in the scripts enumerator.
*** Bug 684940 has been marked as a duplicate of this bug. ***