Debug-only incremental GC crash [@ js::ReentrancyGuard::ReentrancyGuard]

RESOLVED WORKSFORME

Status

()

--
critical
RESOLVED WORKSFORME
7 years ago
6 years ago

People

(Reporter: jruderman, Unassigned)

Tracking

({crash, testcase})

Trunk
x86_64
Mac OS X
crash, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

7 years ago
Created attachment 599006 [details]
crash log (opt-debug)

My DOM fuzzer keeps hitting crashes like this.  I haven't seen a testcase that looked reproducible, and I don't think I have a way to control incremental GC in the browser (other than turning it off).

The call to ValidateIncrementalMarking is DEBUG-only.
(Reporter)

Comment 1

7 years ago
Created attachment 599008 [details]
crash log (debug)
Jesse, is this something you can get in a debugger (by attaching after it crashes or something)?
This was fixed a while ago. I think it had something to do with a freed JSContext being used during an incremental GC.
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.