950942 - GenerationalGC: Assertion failure: !gc::IsInsideNursery(cx->compartment()->runtimeFromAnyThread(), metadata), at vm/Shape.cpp:1663

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central built with --enable-exact-rooting --enable-gcgenerational, revision 1ad9af3a2ab8 (run with --fuzzing-safe --ion-check-range-analysis --ion-eager --ion-compile-try-catch):


incallback = false;
function callback(obj) {
    if (incallback)
	return null;
    incallback = true;
    var res = {};
    incallback = false;
    return res;
}
setObjectMetadataCallback(callback);
var s = Set();
var obj = {};
referencesVia(s, (1), obj)
function referencesVia(from, edge, to) {
    var edges = findReferences(to);
    if (alternatives.length == 0) {}
}

Comment 1

[Jon Coppeard (:jonco)]

This no longer reproduces since that assertion was removed by bug 951213.