Closed Bug 885885 Opened 7 years ago Closed 7 years ago

GenerationalGC: Assertion failure: isForwarded(), at gc/Nursery-inl.h

Categories

(Core :: JavaScript Engine, defect, critical)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 885607

People

(Reporter: gkw, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

Attached file stack
The upcoming testcase crashes js debug shell (tested with a threadsafe deterministic 64-bit debug build) on m-c changeset PLSREPLACEME with --ion-parallel-compile=on --thread-count=13 --ion-osr=off --ion-limit-script-size=off --ion-regalloc=backtracking at Assertion failure: isForwarded(), at gc/Nursery-inl.h

This bug occurs unreliably, but I can get a coredump if needed.

CC="gcc -m32" AR=ar PKG_CONFIG_LIBDIR=/usr/lib/pkgconfig CXX="g++ -m32" sh configure --target=i686-pc-linux --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-exact-rooting --enable-gcgenerational --enable-threadsafe

(you may need --with-system-nspr)
> The upcoming testcase crashes js debug shell (tested with a threadsafe
> deterministic 64-bit debug build) on m-c changeset PLSREPLACEME with

I meant that this was a 32-bit debug build, on m-i changeset 7addaeb4e9ad. Template fail..
Reproduced, it's hitting the same problem that we fixed in bug 885607.
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 885607
Blocks: 826741
You need to log in before you can comment on or make changes to this bug.