Last Comment Bug 750416 - Assertion failure: *vpp <= *endp in restoreValueArray
: Assertion failure: *vpp <= *endp in restoreValueArray
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: mozilla15
Assigned To: Bill McCloskey (:billm)
:
Mentors:
Depends on:
Blocks: 735099
  Show dependency treegraph
 
Reported: 2012-04-30 12:41 PDT by Bill McCloskey (:billm)
Modified: 2012-05-02 21:18 PDT (History)
3 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
patch (1.34 KB, patch)
2012-04-30 12:41 PDT, Bill McCloskey (:billm)
no flags Details | Diff | Splinter Review
patch with test (2.14 KB, patch)
2012-04-30 12:42 PDT, Bill McCloskey (:billm)
igor: review+
Details | Diff | Splinter Review

Description Bill McCloskey (:billm) 2012-04-30 12:41:26 PDT
Created attachment 619645 [details] [diff] [review]
patch

I found this while tryservering the incremental GC code and managed to turn it into a unit test. If the slotspan of an object decreases during marking, and if the slotspan was below the number of fixed slots, then we'll assert. This patch just handles the decrease more carefully.
Comment 1 Bill McCloskey (:billm) 2012-04-30 12:42:51 PDT
Created attachment 619646 [details] [diff] [review]
patch with test

Oops. Forgot the test.
Comment 2 Igor Bukanov 2012-04-30 13:36:13 PDT
Comment on attachment 619646 [details] [diff] [review]
patch with test

Review of attachment 619646 [details] [diff] [review]:
-----------------------------------------------------------------

Nice catch!
Comment 4 :Ehsan Akhgari (away Aug 1-5) 2012-05-02 21:18:42 PDT
https://hg.mozilla.org/mozilla-central/rev/ea0c9e5dd1b7

Note You need to log in before you can comment on or make changes to this bug.