Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now) Reporter
	Description • 14 years ago

{
    gczeal(2)
}
(function () {
    ''.w()
})()

asserts js debug shell on JM changeset 2ee92d697741 with -m at Assertion failure: begin <= end, at ../jsgc.cpp:1265

	Andrew Drake [:adrake] Assignee
	Comment 1 • 14 years ago

Only occurs on 32bit with ICs enabled.

	Andrew Drake [:adrake] Assignee
	Comment 2 • 14 years ago

Not terribly useful, but bisection results:

Changeset 49100:c387ce88e5b0: bad
The first bad revision is:
changeset:   49100:c387ce88e5b0
parent:      49095:aad930cb9dc0
user:        David Anderson <danderson@mozilla.com>
date:        Thu Jul 29 17:13:08 2010 -0700
summary:     [JAEGER] Conservatively scan the JS stack (bug 583084, GC changes r=gregor).

	Andrew Drake [:adrake] Assignee
	Comment 3 • 14 years ago

It's a bit of a band-aid, but it would require some pretty major restructuring to make this less ugly, and I don't trust myself to refactor the surrounding code without breaking it. I suspect there are other bugs of this class showing up in other gc failures (tasty tasty gczeal).

	David Anderson [:dvander] - inactive, e-mail if emergency
	Comment 4 • 14 years ago

Could you explain what is happening here? I don't understand the fix.

	Andrew Drake [:adrake] Assignee
	Comment 5 • 14 years ago

Fixes a doc typo that would have left future readers dazed and confused.

	David Anderson [:dvander] - inactive, e-mail if emergency
	Comment 7 • 14 years ago

Comment on attachment 462329 [details] [diff] [review]
Patch v2

Nice debugging, thanks for taking this. Bad GC interactions sure do suck.

	Andrew Drake [:adrake] Assignee
	Comment 8 • 14 years ago

http://hg.mozilla.org/users/danderson_mozilla.com/moo/rev/7465ce759e81

	Christian Holler (:decoder)
	Comment 9 • 12 years ago

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929