749698 - Assertion failure: any, at jsgc.cpp:3303

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

The following asserts on mozilla-inbound revision 2b2419d14197:

it.custom = 0;

$ ./js test.js
Assertion failure: any, at jsgc.cpp:3303

Seems to be shell-only and caused by the "it"-object somehow, but this assert prevents me from landing bug 738525.

Comment 1

[Jan de Mooij [:jandem]]

hg bisect points to bug 739899, revision 94199cf080a3.

Bill can you take a look?

Comment 2

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: fix

Sorry about that. When gcPoke gets set and we GC again, we need to tell it which compartments to collect.

Comment 3

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/84ec0fadb88c

Comment 4

[(no longer active)]

https://hg.mozilla.org/mozilla-central/rev/84ec0fadb88c