Closed Bug 957110 Opened 7 years ago Closed 7 years ago

GenerationalGC: Assertion failure: currentStart_ == start(), at gc/Nursery.cpp:103 with OOM

Categories

(Core :: JavaScript Engine, defect)

x86
Linux
defect
Not set
major

Tracking

()

RESOLVED FIXED
mozilla29

People

(Reporter: decoder, Assigned: jonco)

References

Details

(Keywords: assertion, testcase, Whiteboard: [jsbugmon:ignore])

Attachments

(1 file)

The following testcase asserts on mozilla-central built with --enable-exact-rooting --enable-gcgenerational, revision 325c74addeba (run with --fuzzing-safe):


gczeal(7,1);
try {
gcparam("maxBytes", gcparam("gcBytes") + 4*1024);
newGlobal("same-compartment");
} catch(exc1) {}
gczeal(1);
Assignee: nobody → jcoppeard
This testcase turns on nursery zeal mode and then sets a low gcMaxBytes allocation threshold.  This results in the nursery being disabled after attempting to allocate the new global.  When we leave nursery zeal mode, the current chunk is not set to zero because the nursery is disabled.  This is not actually a problem because it will be set when the nursery is re-enabled again.  So the fix is to weaken the failing assert so that it the current start is not checked if the nursery is disabled.
Attachment #8357785 - Flags: review?(terrence)
Comment on attachment 8357785 [details] [diff] [review]
bug957110-nursery-empty-assertion

Review of attachment 8357785 [details] [diff] [review]:
-----------------------------------------------------------------

I could have sworn I found and fixed the same issue when testing the zeal7 robustness rewrite a few months ago. Oh well, this is the correct fix. r=me
Attachment #8357785 - Flags: review?(terrence) → review+
https://hg.mozilla.org/mozilla-central/rev/cbe9f7791348
Status: NEW → RESOLVED
Closed: 7 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla29
You need to log in before you can comment on or make changes to this bug.