The default bug view has changed. See this FAQ.

"Assertion failure: rt->gcMode != JSGC_MODE_GLOBAL" with certain GC prefs and forceShrinkingGC

RESOLVED FIXED in mozilla13

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: Jesse Ruderman, Assigned: billm)

Tracking

({assertion, regression, testcase})

Trunk
mozilla13
x86_64
Mac OS X
assertion, regression, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Created attachment 604789 [details]
testcase

1. Install the new version of 
  https://www.squarefree.com/extensions/domFuzzLite3.xpi

2. Set

user_pref("javascript.options.mem.gc_incremental", false);
user_pref("javascript.options.mem.gc_per_compartment", false);

3. Load the testcase.

Result:
Assertion failure: rt->gcMode != JSGC_MODE_GLOBAL, at jsgc.cpp:3600


Based on the stack trace, I suspect this is a regression from the following chunk of bug 730447's patch:

@ MaybeGC
+    if (comp->gcMallocAndFreeBytes >= comp->gcTriggerMallocAndFreeBytes) {
+        GCSlice(cx, comp, GC_NORMAL, gcreason::MAYBEGC);
+        return;
+    }
(Assignee)

Comment 1

5 years ago
Created attachment 605011 [details] [diff] [review]
fix

This fixes two problems:
1. We're triggering a compartment GC when we're not supposed to.
2. We're triggering a GC when malloc bytes and trigger malloc bytes are both 0.
Assignee: general → wmccloskey
Status: NEW → ASSIGNED
Attachment #605011 - Flags: review?(anygregor)
Attachment #605011 - Flags: review?(anygregor) → review+
(Assignee)

Comment 2

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/ee1534c3a8e7
Target Milestone: --- → mozilla13
https://hg.mozilla.org/mozilla-central/rev/ee1534c3a8e7
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.