If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

[IncrementalGC] "Assertion failure: IsMarkedOrAllocated(static_cast<Cell *>(thing))" with adoptNode, gczeal(4)

RESOLVED DUPLICATE of bug 715761

Status

()

Core
JavaScript Engine
--
critical
RESOLVED DUPLICATE of bug 715761
6 years ago
5 years ago

People

(Reporter: Jesse Ruderman, Assigned: billm)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
x86_64
Mac OS X
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

6 years ago
Created attachment 599816 [details]
testcase

1. Install https://www.squarefree.com/extensions/domFuzzLite3.xpi
2. Load the testcase

Assertion failure: IsMarkedOrAllocated(static_cast<Cell *>(thing)), at js/src/jsgc.cpp:4364

(Continuation of bug 704258?)

(I'm confused: why does gczeal(4) matter even when followed by gczeal(0)?)
(Reporter)

Comment 1

6 years ago
Created attachment 599829 [details]
stack trace
(Assignee)

Updated

6 years ago
Assignee: general → wmccloskey
Blocks: 641025
(Assignee)

Comment 2

5 years ago
Once bug 715761 is fully landed (just one more small patch to go), this will get fixed.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 715761
You need to log in before you can comment on or make changes to this bug.