The default bug view has changed. See this FAQ.

Assertion failure: !rt->gcRunning, at jsgc.cpp:2083

RESOLVED FIXED in mozilla11

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
4 years ago

People

(Reporter: decoder, Assigned: billm)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla11
x86
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: js-triage-needed)

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
The following test asserts on mozilla-central revision 41f75cbb91f2 (options -m -n -a):


function startTest() {
 if (typeof document != "object" 
    || !document.location.href.match(/jsreftest.html/))  {}
};
gczeal(4);
startTest();
ArrayBuffer( 946684800000 );


Not S-s due to incremental gc.
(Assignee)

Updated

5 years ago
Assignee: general → wmccloskey
(Assignee)

Comment 1

5 years ago
Created attachment 582365 [details] [diff] [review]
fix

This is the problem we talked about a while ago where we remove an entry from a hashtable during GC. The remove method calls malloc, which can trigger a GC. I just turned the assert into a condition. Ideally we wouldn't malloc during GC, but this fix is safe and the fix to HashMap::remove would be annoying and not really necessary.
Attachment #582365 - Flags: review?(luke)

Updated

5 years ago
Attachment #582365 - Flags: review?(luke) → review+
(Assignee)

Comment 2

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/9d6469ffd577
Target Milestone: --- → mozilla11
https://hg.mozilla.org/mozilla-central/rev/9d6469ffd577
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
(Reporter)

Comment 4

4 years ago
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug710947.js.
Flags: in-testsuite+
Depends on: 830931
You need to log in before you can comment on or make changes to this bug.