710947 - Assertion failure: !rt->gcRunning, at jsgc.cpp:2083

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test asserts on mozilla-central revision 41f75cbb91f2 (options -m -n -a):


function startTest() {
 if (typeof document != "object" 
    || !document.location.href.match(/jsreftest.html/))  {}
};
gczeal(4);
startTest();
ArrayBuffer( 946684800000 );


Not S-s due to incremental gc.

Comment 1

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: fix

This is the problem we talked about a while ago where we remove an entry from a hashtable during GC. The remove method calls malloc, which can trigger a GC. I just turned the assert into a condition. Ideally we wouldn't malloc during GC, but this fix is safe and the fix to HashMap::remove would be annoying and not really necessary.

Comment 2

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/9d6469ffd577

Comment 3

[Matt Brubeck (:mbrubeck)]

https://hg.mozilla.org/mozilla-central/rev/9d6469ffd577

Comment 4

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug710947.js.