Last Comment Bug 707750 - Assertion failure: static_cast<Cell *>(thing)->isMarked(), at jsgc.cpp:3530
: Assertion failure: static_cast<Cell *>(thing)->isMarked(), at jsgc.cpp:3530
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Linux
: -- critical (vote)
: mozilla11
Assigned To: Bill McCloskey (:billm)
:
:
Mentors:
Depends on: 714616
Blocks: langfuzz
  Show dependency treegraph
 
Reported: 2011-12-05 10:29 PST by Christian Holler (:decoder)
Modified: 2013-01-14 08:31 PST (History)
4 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
fix (1.20 KB, patch)
2011-12-06 14:15 PST, Bill McCloskey (:billm)
bhackett1024: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2011-12-05 10:29:59 PST
The following test asserts on mozilla-central revision cb70391c86d9 (options -m -n -a):


var lfcode = new Array();
lfcode.push("gczeal(4);");
lfcode.push('print(BUGNUMBER + ": " + (W       --    ));');
while (true) {
        var file = lfcode.shift(); if (file == undefined) { break; }
        eval(file);
}


Not s-s due to gczeal(4) (incremental GC).
Comment 1 Bill McCloskey (:billm) 2011-12-06 14:15:19 PST
Created attachment 579456 [details] [diff] [review]
fix

I think this somehow got broken during the objshrink merge.
Comment 3 Ed Morley [:emorley] 2011-12-07 02:32:41 PST
https://hg.mozilla.org/mozilla-central/rev/66d577078bb1
Comment 4 Christian Holler (:decoder) 2013-01-14 08:31:42 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug707750.js.

Note You need to log in before you can comment on or make changes to this bug.