The default bug view has changed. See this FAQ.

Assertion failure: *vpp <= *endp in restoreValueArray

RESOLVED FIXED in mozilla15

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: billm, Assigned: billm)

Tracking

unspecified
mozilla15
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment, 1 obsolete attachment)

(Assignee)

Description

5 years ago
Created attachment 619645 [details] [diff] [review]
patch

I found this while tryservering the incremental GC code and managed to turn it into a unit test. If the slotspan of an object decreases during marking, and if the slotspan was below the number of fixed slots, then we'll assert. This patch just handles the decrease more carefully.
Attachment #619645 - Flags: review?(igor)
(Assignee)

Comment 1

5 years ago
Created attachment 619646 [details] [diff] [review]
patch with test

Oops. Forgot the test.
Attachment #619645 - Attachment is obsolete: true
Attachment #619645 - Flags: review?(igor)
Attachment #619646 - Flags: review?(igor)
(Assignee)

Updated

5 years ago
Blocks: 735099

Comment 2

5 years ago
Comment on attachment 619646 [details] [diff] [review]
patch with test

Review of attachment 619646 [details] [diff] [review]:
-----------------------------------------------------------------

Nice catch!
Attachment #619646 - Flags: review?(igor) → review+
(Assignee)

Comment 3

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/ea0c9e5dd1b7
Target Milestone: --- → mozilla15
https://hg.mozilla.org/mozilla-central/rev/ea0c9e5dd1b7
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.