Closed Bug 728976 Opened 12 years ago Closed 12 years ago

Debug-only incremental GC crash [@ js::ReentrancyGuard::ReentrancyGuard]

Categories

(Core :: JavaScript Engine, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: jruderman, Unassigned)

References

Details

(Keywords: crash, testcase)

Attachments

(2 files)

Attached file crash log (opt-debug)
My DOM fuzzer keeps hitting crashes like this.  I haven't seen a testcase that looked reproducible, and I don't think I have a way to control incremental GC in the browser (other than turning it off).

The call to ValidateIncrementalMarking is DEBUG-only.
Attached file crash log (debug)
Jesse, is this something you can get in a debugger (by attaching after it crashes or something)?
This was fixed a while ago. I think it had something to do with a freed JSContext being used during an incremental GC.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.