Last Comment Bug 750416 - Assertion failure: *vpp <= *endp in restoreValueArray
: Assertion failure: *vpp <= *endp in restoreValueArray
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: mozilla15
Assigned To: Bill McCloskey (:billm)
Depends on:
Blocks: 735099
  Show dependency treegraph
Reported: 2012-04-30 12:41 PDT by Bill McCloskey (:billm)
Modified: 2012-05-02 21:18 PDT (History)
3 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

patch (1.34 KB, patch)
2012-04-30 12:41 PDT, Bill McCloskey (:billm)
no flags Details | Diff | Review
patch with test (2.14 KB, patch)
2012-04-30 12:42 PDT, Bill McCloskey (:billm)
igor: review+
Details | Diff | Review

Description Bill McCloskey (:billm) 2012-04-30 12:41:26 PDT
Created attachment 619645 [details] [diff] [review]

I found this while tryservering the incremental GC code and managed to turn it into a unit test. If the slotspan of an object decreases during marking, and if the slotspan was below the number of fixed slots, then we'll assert. This patch just handles the decrease more carefully.
Comment 1 Bill McCloskey (:billm) 2012-04-30 12:42:51 PDT
Created attachment 619646 [details] [diff] [review]
patch with test

Oops. Forgot the test.
Comment 2 Igor Bukanov 2012-04-30 13:36:13 PDT
Comment on attachment 619646 [details] [diff] [review]
patch with test

Review of attachment 619646 [details] [diff] [review]:

Nice catch!
Comment 4 :Ehsan Akhgari (busy, don't ask for review please) 2012-05-02 21:18:42 PDT

Note You need to log in before you can comment on or make changes to this bug.