Last Comment Bug 750416 - Assertion failure: *vpp <= *endp in restoreValueArray
: Assertion failure: *vpp <= *endp in restoreValueArray
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: mozilla15
Assigned To: [PTO to Dec5] Bill McCloskey (:billm)
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: 735099
  Show dependency treegraph
Reported: 2012-04-30 12:41 PDT by [PTO to Dec5] Bill McCloskey (:billm)
Modified: 2012-05-02 21:18 PDT (History)
3 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

patch (1.34 KB, patch)
2012-04-30 12:41 PDT, [PTO to Dec5] Bill McCloskey (:billm)
no flags Details | Diff | Splinter Review
patch with test (2.14 KB, patch)
2012-04-30 12:42 PDT, [PTO to Dec5] Bill McCloskey (:billm)
igor: review+
Details | Diff | Splinter Review

Description [PTO to Dec5] Bill McCloskey (:billm) 2012-04-30 12:41:26 PDT
Created attachment 619645 [details] [diff] [review]

I found this while tryservering the incremental GC code and managed to turn it into a unit test. If the slotspan of an object decreases during marking, and if the slotspan was below the number of fixed slots, then we'll assert. This patch just handles the decrease more carefully.
Comment 1 [PTO to Dec5] Bill McCloskey (:billm) 2012-04-30 12:42:51 PDT
Created attachment 619646 [details] [diff] [review]
patch with test

Oops. Forgot the test.
Comment 2 Igor Bukanov 2012-04-30 13:36:13 PDT
Comment on attachment 619646 [details] [diff] [review]
patch with test

Review of attachment 619646 [details] [diff] [review]:

Nice catch!
Comment 3 [PTO to Dec5] Bill McCloskey (:billm) 2012-04-30 16:00:54 PDT

Note You need to log in before you can comment on or make changes to this bug.