Closed Bug 886909 Opened 11 years ago Closed 11 years ago

GenerationalGC: HashKeyRef for the WatchpointMap is using WatchKey implicitly through type T on the stack. This is firing the pre-barrier on WatchKey::object, but object has already been moved

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
All
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 886551

People

(Reporter: gkw, Assigned: terrence)

References

Details

(Keywords: crash)

Crash Data

+++ This bug was initially created as a clone of Bug #885607 +++

Terrence mentioned in bug 885607 comment 7 about the following problem:

"our HashKeyRef for the WatchpointMap is using the WatchKey implicitly through type T on the stack. This is firing the pre-barrier on WatchKey::object, but the object has already been moved. The pre-barrier's attempt to get obj->zone() is trying to find the zone on shape_, but shape is the relocation magic at this point."
Crash Signature: [@ js::gc::GetGCThingRuntime()]
Thanks for filing, Gary! This is the same as bug 886551, which has a nice short test case, so duping to that one.
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.