TI: Assertion failure: addr % Cell::CellSize == 0, at ../../jsgc.h:711

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
4 years ago

People

(Reporter: decoder, Assigned: bhackett)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Other Branch
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

6 years ago
Created attachment 570430 [details]
Testcase for shell

The attached testcase asserts on jaegermonkey revision b01eb1ba58ce (run with -m -n), tested on 64 bit.
(Reporter)

Updated

6 years ago
Version: Trunk → Other Branch
(Assignee)

Comment 1

6 years ago
Created attachment 570554 [details] [diff] [review]
patch

GC hazard when constructing functions, setSingletonType can now trigger GC and was called before a new function was fully initialized.

https://hg.mozilla.org/projects/jaegermonkey/rev/6c7f986274b9
Assignee: general → bhackett1024
Attachment #570554 - Flags: review?(luke)
(Assignee)

Updated

6 years ago
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Depends on: 700464

Updated

6 years ago
Attachment #570554 - Flags: review?(luke) → review+
(Reporter)

Updated

4 years ago
Attachment #570430 - Attachment mime type: text/plain → application/x-tar
You need to log in before you can comment on or make changes to this bug.