Closed Bug 981296 Opened 6 years ago Closed 6 years ago

GenerationalGC: Assertion failure: table, at js/HashTable.h:1466 or Crash [@ Range] with OOM

Categories

(Core :: JavaScript Engine, defect, major)

x86_64
Linux
defect
Not set
major

Tracking

()

RESOLVED FIXED
mozilla30

People

(Reporter: decoder, Assigned: terrence)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update,bisect])

Attachments

(1 file)

The following testcase asserts on mozilla-central built with --enable-exact-rooting --enable-gcgenerational, revision d01bf8596d3b (run with --fuzzing-safe):


gczeal(13,1);
gcparam("maxBytes", gcparam("gcBytes") + (false  )*1024);
newGlobal("same-compartment");
The initial shapes table is created lazily, so don't verify it is correct before it is created.
Assignee: nobody → terrence
Status: NEW → ASSIGNED
Attachment #8388776 - Flags: review?(sphink)
Attachment #8388776 - Flags: review?(sphink) → review+
https://hg.mozilla.org/mozilla-central/rev/ef99254c03d2
Status: ASSIGNED → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla30
You need to log in before you can comment on or make changes to this bug.