714619 - [IncrementalGC] Assertion failure: IsMarkedOrAllocated(static_cast<Cell *>(thing)), at jsgc.cpp:4226

Status: RESOLVED DUPLICATE of bug 723313

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test asserts on larch branch (incremental GC) revision af4c75977447 (options -m -n -a):


try {
   (function f(i) { 
        f(this +  this); 
   })(1)
} catch (e) {}
gczeal(4);
function g(n, h) {
    var t = g(n - 1, h);
}
for (var i = 0; ( g("Object.create({get a() {}, set a(v) {}})")) < arr.length; i++)
new i(h, x([x[i]]), x(r.arr(/\S/)));

Comment 1

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

I haven't been able to reproduce this so far. How long do i have to run it for?

Comment 2

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

I was able to reproduce this on the langfuzz box. It's a false positive. It was fixed by the patch to use exact scanning for the VM stack.