Last Comment Bug 706641 - [IncrementalGC] Assertion failure: IsMarkedOrAllocated(static_cast<Cell *>(thing)), at jsgc.cpp:4148
: [IncrementalGC] Assertion failure: IsMarkedOrAllocated(static_cast<Cell *>(th...
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Linux
: -- critical (vote)
: ---
Assigned To: [PTO to Dec5] Bill McCloskey (:billm)
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: langfuzz
  Show dependency treegraph
 
Reported: 2011-11-30 13:29 PST by Christian Holler (:decoder)
Modified: 2011-12-06 11:16 PST (History)
3 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Christian Holler (:decoder) 2011-11-30 13:29:43 PST
The following test asserts on larch branch (incremental GC) revision e56cdac82986 (options -m -n -a):


try  {  }  catch(ex) {
  for ( gTc=0; gTc < gTestcases.length; gTc++ ) {  }
}
var lfcode = new Array();
lfcode.push("\
try {\
gczeal(4);gc(actual);\
var box = evalcx('lazy');\n} catch(exc1) {}\
");
lfcode.push("\
expected = '1,';\
  for (var i in i, this, this) {\
    ({ do : 326467 } ).let.switch;\
}\
");
var lfRunTypeId = -1;
loadFile(lfcode[0]);
loadFile(lfcode[1]);
var file = lfcode.shift();
function loadFile(lfVarx) {
  try {
    if (lfVarx.substr(-3) != ".js") {
        switch (null) {
          default: eval(lfVarx);
        }
    }
  } catch (lfVare) {}
}
Comment 1 [PTO to Dec5] Bill McCloskey (:billm) 2011-12-06 11:16:46 PST
Excellent find! I hadn't thought of how rt->gcKeepAtoms affects incremental GC.

https://hg.mozilla.org/projects/larch/rev/228d5b241cce

Note You need to log in before you can comment on or make changes to this bug.