Closed Bug 886909 Opened 7 years ago Closed 7 years ago

GenerationalGC: HashKeyRef for the WatchpointMap is using WatchKey implicitly through type T on the stack. This is firing the pre-barrier on WatchKey::object, but object has already been moved

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
All
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 886551

People

(Reporter: gkw, Assigned: terrence)

References

(Blocks 1 open bug)

Details

(Keywords: crash)

Crash Data

+++ This bug was initially created as a clone of Bug #885607 +++

Terrence mentioned in bug 885607 comment 7 about the following problem:

"our HashKeyRef for the WatchpointMap is using the WatchKey implicitly through type T on the stack. This is firing the pre-barrier on WatchKey::object, but the object has already been moved. The pre-barrier's attempt to get obj->zone() is trying to find the zone on shape_, but shape is the relocation magic at this point."
Crash Signature: [@ js::gc::GetGCThingRuntime()]
Thanks for filing, Gary! This is the same as bug 886551, which has a nice short test case, so duping to that one.
Status: ASSIGNED → RESOLVED
Closed: 7 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 886881
Duplicate of bug: 886551
You need to log in before you can comment on or make changes to this bug.