Last Comment Bug 750416 - Assertion failure: *vpp <= *endp in restoreValueArray
: Assertion failure: *vpp <= *endp in restoreValueArray
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
-- normal (vote)
: mozilla15
Assigned To: Bill McCloskey (:billm)
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: 735099
  Show dependency treegraph
Reported: 2012-04-30 12:41 PDT by Bill McCloskey (:billm)
Modified: 2012-05-02 21:18 PDT (History)
3 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

patch (1.34 KB, patch)
2012-04-30 12:41 PDT, Bill McCloskey (:billm)
no flags Details | Diff | Splinter Review
patch with test (2.14 KB, patch)
2012-04-30 12:42 PDT, Bill McCloskey (:billm)
igor: review+
Details | Diff | Splinter Review

Description User image Bill McCloskey (:billm) 2012-04-30 12:41:26 PDT
Created attachment 619645 [details] [diff] [review]

I found this while tryservering the incremental GC code and managed to turn it into a unit test. If the slotspan of an object decreases during marking, and if the slotspan was below the number of fixed slots, then we'll assert. This patch just handles the decrease more carefully.
Comment 1 User image Bill McCloskey (:billm) 2012-04-30 12:42:51 PDT
Created attachment 619646 [details] [diff] [review]
patch with test

Oops. Forgot the test.
Comment 2 User image Igor Bukanov 2012-04-30 13:36:13 PDT
Comment on attachment 619646 [details] [diff] [review]
patch with test

Review of attachment 619646 [details] [diff] [review]:

Nice catch!

Note You need to log in before you can comment on or make changes to this bug.