Created attachment 599006 [details] crash log (opt-debug) My DOM fuzzer keeps hitting crashes like this. I haven't seen a testcase that looked reproducible, and I don't think I have a way to control incremental GC in the browser (other than turning it off). The call to ValidateIncrementalMarking is DEBUG-only.
Jesse, is this something you can get in a debugger (by attaching after it crashes or something)?
This was fixed a while ago. I think it had something to do with a freed JSContext being used during an incremental GC.
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.