Closed Bug 728976 Opened 12 years ago Closed 12 years ago

Debug-only incremental GC crash [@ js::ReentrancyGuard::ReentrancyGuard]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: jruderman, Unassigned)

References

Details

(Keywords: crash, testcase)

Attachments

(2 files)

crash log (opt-debug)
4.37 KB, text/plain
Details
crash log (debug)
66.77 KB, text/plain
Details
Attached file crash log (opt-debug) — 
My DOM fuzzer keeps hitting crashes like this.  I haven't seen a testcase that looked reproducible, and I don't think I have a way to control incremental GC in the browser (other than turning it off).

The call to ValidateIncrementalMarking is DEBUG-only.
Attached file crash log (debug) — 

    
    

    
  
Jesse, is this something you can get in a debugger (by attaching after it crashes or something)?

    
    

    
  
This was fixed a while ago. I think it had something to do with a freed JSContext being used during an incremental GC.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → WORKSFORME

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: