684796 - Assertion failure: freeLists[kind].isEmpty()

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Nicholas Nethercote [:njn]]

js> mjitdatastats()
Assertion failure: freeLists[kind].isEmpty(), at /home/njn/moz/mi6/js/src/jsgc.h:1081
Aborted (core dumped)


I'm guessing this is related to bug 674251.

Comment 1

[Nicholas Nethercote [:njn]]

I should say that removing mjitstats() from the shell would be an acceptable fix for this, IMHO, because I doubt anyone uses it.

But it would be good to know what the real problem is and if it could have other bad effects.

Comment 2

[Igor Bukanov]

Attachment: v1

In the bug 674251 I have used too strict assert in the gc::CellIter. The ieterator should allow for non-empty free lists synchronized with the arenas during the GC to support pseudo-GC sessions like one setup for cell enumeration.

This patch fixes that and also fixes another regression from bug 674251 where I wrongfully used gc::FINALIZE_TYPE_OBJECT, not gc::FINALIZE_SCRIPT, in the scripts enumerator.

Comment 3

[Igor Bukanov]

http://hg.mozilla.org/integration/mozilla-inbound/rev/f76296e27bcb

Comment 4

[:ehsan akhgari]

http://hg.mozilla.org/mozilla-central/rev/f76296e27bcb