Closed Bug 707750 Opened 8 years ago Closed 8 years ago

Assertion failure: static_cast<Cell *>(thing)->isMarked(), at jsgc.cpp:3530

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla11

People

(Reporter: decoder, Assigned: billm)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

The following test asserts on mozilla-central revision cb70391c86d9 (options -m -n -a):


var lfcode = new Array();
lfcode.push("gczeal(4);");
lfcode.push('print(BUGNUMBER + ": " + (W       --    ));');
while (true) {
        var file = lfcode.shift(); if (file == undefined) { break; }
        eval(file);
}


Not s-s due to gczeal(4) (incremental GC).
Attached patch fixSplinter Review
I think this somehow got broken during the objshrink merge.
Attachment #579456 - Flags: review?(bhackett1024)
Attachment #579456 - Flags: review?(bhackett1024) → review+
https://hg.mozilla.org/mozilla-central/rev/66d577078bb1
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Depends on: 714616
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug707750.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.