The default bug view has changed. See this FAQ.

[IncrementalGC] Assertion failure: IsMarkedOrAllocated(static_cast<Cell *>(thing)), at jsgc.cpp:4148

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Assigned: billm)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Other Branch
x86_64
Linux
assertion, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

5 years ago
The following test asserts on larch branch (incremental GC) revision e56cdac82986 (options -m -n -a):


try  {  }  catch(ex) {
  for ( gTc=0; gTc < gTestcases.length; gTc++ ) {  }
}
var lfcode = new Array();
lfcode.push("\
try {\
gczeal(4);gc(actual);\
var box = evalcx('lazy');\n} catch(exc1) {}\
");
lfcode.push("\
expected = '1,';\
  for (var i in i, this, this) {\
    ({ do : 326467 } ).let.switch;\
}\
");
var lfRunTypeId = -1;
loadFile(lfcode[0]);
loadFile(lfcode[1]);
var file = lfcode.shift();
function loadFile(lfVarx) {
  try {
    if (lfVarx.substr(-3) != ".js") {
        switch (null) {
          default: eval(lfVarx);
        }
    }
  } catch (lfVare) {}
}
(Assignee)

Comment 1

5 years ago
Excellent find! I hadn't thought of how rt->gcKeepAtoms affects incremental GC.

https://hg.mozilla.org/projects/larch/rev/228d5b241cce
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.