GenerationalGC: Assertion failure: !gc::IsInsideNursery(cx->compartment()->runtimeFromAnyThread(), metadata), at vm/Shape.cpp:1663

RESOLVED WORKSFORME

Status

()

Core
JavaScript Engine
--
major
RESOLVED WORKSFORME
4 years ago
4 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:ignore])

(Reporter)

Description

4 years ago
The following testcase asserts on mozilla-central built with --enable-exact-rooting --enable-gcgenerational, revision 1ad9af3a2ab8 (run with --fuzzing-safe --ion-check-range-analysis --ion-eager --ion-compile-try-catch):


incallback = false;
function callback(obj) {
    if (incallback)
	return null;
    incallback = true;
    var res = {};
    incallback = false;
    return res;
}
setObjectMetadataCallback(callback);
var s = Set();
var obj = {};
referencesVia(s, (1), obj)
function referencesVia(from, edge, to) {
    var edges = findReferences(to);
    if (alternatives.length == 0) {}
}
This no longer reproduces since that assertion was removed by bug 951213.
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.