Last Comment Bug 710947 - Assertion failure: !rt->gcRunning, at jsgc.cpp:2083
: Assertion failure: !rt->gcRunning, at jsgc.cpp:2083
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Linux
-- critical (vote)
: mozilla11
Assigned To: Bill McCloskey (:billm)
: Jason Orendorff [:jorendorff]
Depends on: 830931
Blocks: langfuzz
  Show dependency treegraph
Reported: 2011-12-14 17:46 PST by Christian Holler (:decoder)
Modified: 2013-01-15 12:30 PST (History)
6 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

fix (1.08 KB, patch)
2011-12-16 12:53 PST, Bill McCloskey (:billm)
luke: review+
Details | Diff | Splinter Review

Description User image Christian Holler (:decoder) 2011-12-14 17:46:47 PST
The following test asserts on mozilla-central revision 41f75cbb91f2 (options -m -n -a):

function startTest() {
 if (typeof document != "object" 
    || !document.location.href.match(/jsreftest.html/))  {}
ArrayBuffer( 946684800000 );

Not S-s due to incremental gc.
Comment 1 User image Bill McCloskey (:billm) 2011-12-16 12:53:30 PST
Created attachment 582365 [details] [diff] [review]

This is the problem we talked about a while ago where we remove an entry from a hashtable during GC. The remove method calls malloc, which can trigger a GC. I just turned the assert into a condition. Ideally we wouldn't malloc during GC, but this fix is safe and the fix to HashMap::remove would be annoying and not really necessary.
Comment 3 User image Matt Brubeck (:mbrubeck) 2011-12-17 09:27:40 PST
Comment 4 User image Christian Holler (:decoder) 2013-01-14 08:47:48 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug710947.js.

Note You need to log in before you can comment on or make changes to this bug.