Last Comment Bug 749698 - Assertion failure: any, at jsgc.cpp:3303
: Assertion failure: any, at jsgc.cpp:3303
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: mozilla15
Assigned To: Bill McCloskey (:billm)
:
Mentors:
Depends on:
Blocks: 738525 739899
  Show dependency treegraph
 
Reported: 2012-04-27 10:46 PDT by Jan de Mooij [:jandem] (PTO until July 31)
Modified: 2012-05-07 16:10 PDT (History)
8 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
fix (1.35 KB, patch)
2012-04-27 12:21 PDT, Bill McCloskey (:billm)
igor: review+
Details | Diff | Splinter Review

Description Jan de Mooij [:jandem] (PTO until July 31) 2012-04-27 10:46:53 PDT
The following asserts on mozilla-inbound revision 2b2419d14197:

it.custom = 0;

$ ./js test.js
Assertion failure: any, at jsgc.cpp:3303

Seems to be shell-only and caused by the "it"-object somehow, but this assert prevents me from landing bug 738525.
Comment 1 Jan de Mooij [:jandem] (PTO until July 31) 2012-04-27 11:41:10 PDT
hg bisect points to bug 739899, revision 94199cf080a3.

Bill can you take a look?
Comment 2 Bill McCloskey (:billm) 2012-04-27 12:21:36 PDT
Created attachment 619140 [details] [diff] [review]
fix

Sorry about that. When gcPoke gets set and we GC again, we need to tell it which compartments to collect.

Note You need to log in before you can comment on or make changes to this bug.