Closed Bug 977860 Opened 6 years ago Closed 6 years ago

Assertion failure: (0 == munmap(p, size)), at gc/Memory.cpp:257

Categories

(Core :: JavaScript Engine, defect, major)

x86
Linux
defect
Not set
major

Tracking

()

RESOLVED DUPLICATE of bug 978498
Tracking Status
firefox30 --- affected

People

(Reporter: decoder, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

The following testcase asserts on mozilla-central revision 4cfb6c61b137 (run with --fuzzing-safe):


do { 
  new SharedArrayBuffer(0x1000);
} while (true);
Blocks: 933001
Flags: needinfo?(sstangl)
Whiteboard: [jsbugmon:update]
munmap() is failing with ENOMEM, which is amusing.
Flags: needinfo?(sstangl)
Pages are being leaked when deallocating the buffer.  The patch in bug 978498 addresses this.

It might also be that the garbage collector is not being called.  The following looks stable with the patch in bug 978498:

do { 
  new SharedArrayBuffer(0x1000);
  gc()
} while (true);
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision d2dac18d0562).
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:bisectfix]
Bisection isn't necessary -- it was fixed by Bug 978498 (as in Comment 2), which closed a memory leak.
Thanks Sean :)
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → DUPLICATE
Whiteboard: [jsbugmon:bisectfix]
Duplicate of bug: 978498
You need to log in before you can comment on or make changes to this bug.