Closed
Bug 728976
Opened 13 years ago
Closed 12 years ago
Debug-only incremental GC crash [@ js::ReentrancyGuard::ReentrancyGuard]
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: jruderman, Unassigned)
References
Details
(Keywords: crash, testcase)
Attachments
(2 files)
My DOM fuzzer keeps hitting crashes like this. I haven't seen a testcase that looked reproducible, and I don't think I have a way to control incremental GC in the browser (other than turning it off).
The call to ValidateIncrementalMarking is DEBUG-only.
|
Reporter | |
Comment 1•13 years ago
|
||
Jesse, is this something you can get in a debugger (by attaching after it crashes or something)?
This was fixed a while ago. I think it had something to do with a freed JSContext being used during an incremental GC.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → WORKSFORME
You need to log in
before you can comment on or make changes to this bug.
Description
•