885885 - GenerationalGC: Assertion failure: isForwarded(), at gc/Nursery-inl.h

Status: RESOLVED DUPLICATE of bug 885607

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

The upcoming testcase crashes js debug shell (tested with a threadsafe deterministic 64-bit debug build) on m-c changeset PLSREPLACEME with --ion-parallel-compile=on --thread-count=13 --ion-osr=off --ion-limit-script-size=off --ion-regalloc=backtracking at Assertion failure: isForwarded(), at gc/Nursery-inl.h

This bug occurs unreliably, but I can get a coredump if needed.

CC="gcc -m32" AR=ar PKG_CONFIG_LIBDIR=/usr/lib/pkgconfig CXX="g++ -m32" sh configure --target=i686-pc-linux --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-exact-rooting --enable-gcgenerational --enable-threadsafe

(you may need --with-system-nspr)

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> The upcoming testcase crashes js debug shell (tested with a threadsafe
> deterministic 64-bit debug build) on m-c changeset PLSREPLACEME with

I meant that this was a 32-bit debug build, on m-i changeset 7addaeb4e9ad. Template fail..

Comment 3

[Terrence Cole [:terrence]]

Reproduced, it's hitting the same problem that we fixed in bug 885607.