Closed
Bug 957107
Opened 11 years ago
Closed 11 years ago
GenerationalGC: Assertion failure: p, at vm/Shape.cpp:1673
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 929546
People
(Reporter: decoder, Unassigned)
References
Details
(Keywords: assertion, testcase, Whiteboard: [jsbugmon:ignore])
The following testcase asserts on mozilla-central built with --enable-exact-rooting --enable-gcgenerational, revision 325c74addeba (run with --fuzzing-safe):
gczeal(7,4);
setObjectMetadataCallback(setObjectMetadataCallback);
function newFunc(x) { new Function(x)(); };
newFunc("try { dump(); } catch(exc1) {}");
|
||
Comment 1•11 years ago
|
||
This crashes because it can't find an entry in the initial shape table:
Catchpoint 1 (signal SIGSEGV), js::EmptyShape::insertInitialShape (cx=0x1b407a0,
shape=0x7ffff435cba0, proto=(JSObject * const) 0x7ffff434d220 [object Error] delegate)
at /home/jon/work/dev/js/src/vm/Shape.cpp:1673
1673 JS_ASSERT(p);
It's been fixed by bug 929546 which just went in.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•