Assertion failure: freeLists[kind].isEmpty()

RESOLVED FIXED in mozilla9

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: njn, Unassigned)

Tracking

unspecified
mozilla9
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
js> mjitdatastats()
Assertion failure: freeLists[kind].isEmpty(), at /home/njn/moz/mi6/js/src/jsgc.h:1081
Aborted (core dumped)


I'm guessing this is related to bug 674251.
(Reporter)

Comment 1

6 years ago
I should say that removing mjitstats() from the shell would be an acceptable fix for this, IMHO, because I doubt anyone uses it.

But it would be good to know what the real problem is and if it could have other bad effects.

Updated

6 years ago
Blocks: 674251
No longer depends on: 674251

Comment 2

6 years ago
Created attachment 558460 [details] [diff] [review]
v1

In the bug 674251 I have used too strict assert in the gc::CellIter. The ieterator should allow for non-empty free lists synchronized with the arenas during the GC to support pseudo-GC sessions like one setup for cell enumeration.

This patch fixes that and also fixes another regression from bug 674251 where I wrongfully used gc::FINALIZE_TYPE_OBJECT, not gc::FINALIZE_SCRIPT, in the scripts enumerator.
Attachment #558460 - Flags: review?(bhackett1024)
Attachment #558460 - Flags: review?(bhackett1024) → review+

Comment 3

6 years ago
http://hg.mozilla.org/integration/mozilla-inbound/rev/f76296e27bcb
http://hg.mozilla.org/mozilla-central/rev/f76296e27bcb
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla9
Duplicate of this bug: 684940
You need to log in before you can comment on or make changes to this bug.