Last Comment Bug 710933 - [IncrementalGC] Assertion failure: savedTos < gcmarker->stack.tos, at jsgcmark.cpp:810
: [IncrementalGC] Assertion failure: savedTos < gcmarker->stack.tos, at jsgcmar...
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Linux
: -- critical (vote)
: ---
Assigned To: Bill McCloskey (:billm)
:
Mentors:
: 710945 (view as bug list)
Depends on:
Blocks: langfuzz
  Show dependency treegraph
 
Reported: 2011-12-14 16:56 PST by Christian Holler (:decoder)
Modified: 2011-12-16 16:36 PST (History)
3 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Christian Holler (:decoder) 2011-12-14 16:56:32 PST
The following test asserts on larch branch (incremental GC) revision 591da0d755fa (options -m -n -a):


var appendToActual = function(s) {
    actual += s + ',';
}
actual = '';
function g(a) {
  for (var i = 0; i < 3; ++i) {
    a();
  }
}
function f(y) {
  for (var i = 0; i < 7; -i) {
    q = function() { appendToActual(y); };
    g(q);
  }
}
  f("Function.prototype = null; Function.prototype");
Comment 1 Bill McCloskey (:billm) 2011-12-16 16:31:38 PST
http://hg.mozilla.org/projects/larch/rev/9ff54d96a526
Comment 2 Bill McCloskey (:billm) 2011-12-16 16:36:37 PST
*** Bug 710945 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.