880805 - GenerationalGC: Assertion failure: t->arenaHeader()->allocatedDuringIncremental, at ../jsgcinlines.h:539

Status: RESOLVED DUPLICATE of bug 880816

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

Attachment: Testcase for shell

The attached testcase asserts on mozilla-central built with --enable-exact-rooting --enable-gcgenerational, revision 9ca690835a5e (run with --ion-eager).

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

I know the test is super ugly, but it doesn't get better with reduction. If this one doesn't work for you, let me know and I'll try it from another sample. I'm actually hitting this very often.

Comment 3

[Terrence Cole [:terrence]]

I thought I had commented already, but see now that I did not. I was not able to reproduce this locally: could you try and retest against tip (since the landing of bug 880816)? If it still reproduces, could I get a pre-built copy of the binary to make sure I get the right bits locally?

Comment 4

[Terrence Cole [:terrence]]

Actually, I think we managed to track this down in bug 883472. Does the patch there fix this for you?

Comment 5

[Christian Holler (:decoder)]

I think the test here doesn't reproduce anymore. I'd suggest you just go ahead and land this and I'll resume the fuzzing afterwards. Then I can confirm if this still triggers in the fuzzer somehow.