Assertion failure: static_cast<Cell *>(thing)->isMarked(), at jsgc.cpp:3530

RESOLVED FIXED in mozilla11

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
4 years ago

People

(Reporter: decoder, Assigned: billm)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla11
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
The following test asserts on mozilla-central revision cb70391c86d9 (options -m -n -a):


var lfcode = new Array();
lfcode.push("gczeal(4);");
lfcode.push('print(BUGNUMBER + ": " + (W       --    ));');
while (true) {
        var file = lfcode.shift(); if (file == undefined) { break; }
        eval(file);
}


Not s-s due to gczeal(4) (incremental GC).
(Assignee)

Comment 1

6 years ago
Created attachment 579456 [details] [diff] [review]
fix

I think this somehow got broken during the objshrink merge.
Attachment #579456 - Flags: review?(bhackett1024)
Attachment #579456 - Flags: review?(bhackett1024) → review+
(Assignee)

Comment 2

6 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/66d577078bb1
Target Milestone: --- → mozilla11

Comment 3

6 years ago
https://hg.mozilla.org/mozilla-central/rev/66d577078bb1
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Depends on: 714616
(Reporter)

Comment 4

4 years ago
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug707750.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.