744285 - Assertion failure: IsMarkedOrAllocated(static_cast<Cell *>(*thingp)), at jsgc.cpp:4278

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

Attachment: Test case for shell (run with -n -m -a)

The attached test asserts on mozilla-central revision 3fa30b0edd15 (options -m -a -n).

Marking s-s because this assertion is GC-related.

Billm: Is this a dup of bug 740509 or some other issue?

Comment 1

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: patch

This is a regression from bug 739899. When doing conservative stack scanning, I checked the gcRunning flag to see if we should reject things in other compartments. However, this flag is set by AutoHeapSession (i.e., but pretty much anyone who will use the conservative scanner). We really need to be checking IS_GC_MARKING_TRACER.

This doesn't affect the GC or CC, so I don't think it's sensitive.

Comment 2

[Igor Bukanov]

Comment on attachment 614174 [details] [diff] [review]
patch

Review of attachment 614174 [details] [diff] [review]:
-----------------------------------------------------------------

The test is really nice!

Comment 5

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ca36c6b332d8

Comment 6

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/ca36c6b332d8

Comment 7

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug744285.js.