746136 - Assertion failure: IsMarkedOrAllocated(static_cast<Cell *>(*thingp)), at js/src/jsgc.cpp:4284

Status: RESOLVED DUPLICATE of bug 748119

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test asserts on mozilla-central revision c61e7c3a232a (options -m -n -a):


var lfcode = new Array();
lfcode.push("\
var gTestcases = new Array();\
var gTc = gTestcases.length;\
function startTest() {}\
function TestCase(n, d, e, a) {\
  this.bugnumber = typeof(BUGNUMER) != 'undefined' ? BUGNUMBER : '';\
  gTestcases[gTc++] = this;\
}\
TestCase.prototype.dump = function () {\
  dump('jstest: ' + this.path + ' ' + 'reason: ' + toPrinted(this.reason));\
};\
function writeHeaderToLog( string ) {};\
function jsTestDriverEnd() {\
  for (var i = 0; i < gTestcases.length; i++) {\
    gTestcases[i].dump();\
  }\
}\
var SECTION = \"15.8.2.5\";\
new TestCase( SECTION, Math.atan2(0,-0) );\
");
lfcode.push("try { jsTestDriverEnd(); } catch(exc1) {}");
lfcode.push("\
function getTimeZoneDiff() {}\
var gTestcases = new Array;\
var gTc = gTestcases;\
function TestCase(n, d, e, a) {\
  gTestcases[gTc++]=this;\
}\
TestCase.prototype.dump=function () {};\
gczeal(4);\
addNewTestCase( Date, 999 );\
function addNewTestCase( DateCase, DateString, ResultArray ) {\
 new TestCase;\
 Date.prototype=new TestCase;\
}\
");
lfcode.push("try { jsTestDriverEnd(); } catch(exc1) {}");
while (true) {
        var file = lfcode.shift(); if (file == undefined) { break; }
        loadFile(file);
}
function loadFile(lfVarx) {
        if (lfVarx.substr(-3) == ".js") {
        } else {
                evaluate(lfVarx);
        }
}


Assertion/Crash Symptom: Assertion failure: IsMarkedOrAllocated(static_cast<Cell *>(*thingp)), at js/src/jsgc.cpp:4284

Marking this s-s to be safe, since this is a GC related assert (and I cannot really tell if this is just a verifier bug with no real impact, or if something can go wrong here).