Assertion failure: IsMarkedOrAllocated(static_cast<Cell *>(*thingp)), at jsgc.cpp:4278 with generator

RESOLVED DUPLICATE of bug 744285

Status

()

Core
JavaScript Engine
--
critical
RESOLVED DUPLICATE of bug 744285
6 years ago
5 years ago

People

(Reporter: decoder, Assigned: billm)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

6 years ago
The following test asserts on mozilla-central revision 3fa30b0edd15 (options -m -n):


gczeal(4);
function gen() {
  var c = [1, "x"];
  try {
    yield c;
  } finally {
    gc();
  }
}
var iter = gen();
for (i in iter) {
  (SECTION)();
}



Could be a dup of bug 744287 or any of the other similar assertions, however this uses generators. Marking s-s because this assertion is GC-related.
(Assignee)

Updated

6 years ago
Group: core-security
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 744285
(Reporter)

Comment 2

5 years ago
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug744356.js.
Flags: in-testsuite+
Depends on: 878611
You need to log in before you can comment on or make changes to this bug.