The following test asserts on mozilla-central revision 959c1e6bdb11 (options -m -n -a): gczeal(2); string="" for (var i = 0; i < 100; i++ ) hex=newGlobal('same-compartment'); S-s for now because this is GC related.
I got this too in jsfunfuzz.
And I get this in the browser with RandomJS. (My testcase also uses gczeal.)
Created attachment 562481 [details] [diff] [review] fix This was a bogus assertion, unfortunately. The setOwnerObject call was supposed to happen right after setting u.i.script. But that inadvertently got broken in a few places. I've added a setter to make it less likely for this to happen again.
Assignee: general → wmccloskey
Status: NEW → ASSIGNED
Attachment #562481 - Flags: review?(dmandelin)
Also, not S-S. Except for the assertion, the code was fine.
Whiteboard: js-triage-needed → js-triage-done
Attachment #562481 - Flags: review?(dmandelin) → review+
Target Milestone: --- → mozilla10
Status: ASSIGNED → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug688939.js.
You need to log in before you can comment on or make changes to this bug.