Closed
Bug 750416
Opened 13 years ago
Closed 13 years ago
Assertion failure: *vpp <= *endp in restoreValueArray
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla15
People
(Reporter: billm, Assigned: billm)
References
Details
Attachments
(1 file, 1 obsolete file)
|
(deleted),
patch
|
igor
:
review+
|
Details | Diff | Splinter Review |
I found this while tryservering the incremental GC code and managed to turn it into a unit test. If the slotspan of an object decreases during marking, and if the slotspan was below the number of fixed slots, then we'll assert. This patch just handles the decrease more carefully.
Attachment #619645 -
Flags: review?(igor)
|
Assignee | |
Comment 1•13 years ago
|
||
Oops. Forgot the test.
Attachment #619645 -
Attachment is obsolete: true
Attachment #619645 -
Flags: review?(igor)
Attachment #619646 -
Flags: review?(igor)
|
||
Comment 2•13 years ago
|
||
Comment on attachment 619646 [details] [diff] [review]
patch with test
Review of attachment 619646 [details] [diff] [review]:
-----------------------------------------------------------------
Nice catch!
Attachment #619646 -
Flags: review?(igor) → review+
|
|
Assignee | |
Comment 3•13 years ago
|
||
Target Milestone: --- → mozilla15
|
||
Comment 4•13 years ago
|
||
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•