Closed Bug 710947 Opened 8 years ago Closed 8 years ago

Assertion failure: !rt->gcRunning, at jsgc.cpp:2083

Categories

(Core :: JavaScript Engine, defect, critical)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla11

People

(Reporter: decoder, Assigned: billm)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: js-triage-needed)

Attachments

(1 file)

The following test asserts on mozilla-central revision 41f75cbb91f2 (options -m -n -a):


function startTest() {
 if (typeof document != "object" 
    || !document.location.href.match(/jsreftest.html/))  {}
};
gczeal(4);
startTest();
ArrayBuffer( 946684800000 );


Not S-s due to incremental gc.
Assignee: general → wmccloskey
Attached patch fixSplinter Review
This is the problem we talked about a while ago where we remove an entry from a hashtable during GC. The remove method calls malloc, which can trigger a GC. I just turned the assert into a condition. Ideally we wouldn't malloc during GC, but this fix is safe and the fix to HashMap::remove would be annoying and not really necessary.
Attachment #582365 - Flags: review?(luke)
Attachment #582365 - Flags: review?(luke) → review+
https://hg.mozilla.org/mozilla-central/rev/9d6469ffd577
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug710947.js.
Flags: in-testsuite+
Depends on: 830931
You need to log in before you can comment on or make changes to this bug.