Closed
Bug 981295
Opened 11 years ago
Closed 11 years ago
GenerationalGC: Assertion failure: !(*thingp)->arenaHeader()->allocatedDuringIncremental, at gc/Marking.cpp:364
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla30
People
(Reporter: decoder, Assigned: terrence)
References
Details
(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update,bisect])
Attachments
(1 file)
|
(deleted),
patch
|
sfink
:
review+
|
Details | Diff | Splinter Review |
The following testcase asserts on mozilla-central built with --enable-exact-rooting --enable-gcgenerational, revision d01bf8596d3b (run with --fuzzing-safe):
var NotEarlyErrorString = "NotEarlyError";
var NotEarlyError = new Error(NotEarlyErrorString);
var juneDate = new Date(2000, 5, 20, 0, 0, 0, 0);
for (var i = 0; i < function(x) myObj(Date.prototype.toString.apply(x)); void i) {
eval(a.text.replace(/@/g, ""))
}
gcslice(2600);
function testcase() {}
new Uint16Array(testcase);
|
Assignee | |
Comment 1•11 years ago
|
||
Since IsAboutToBeFinalized only wants to be called for weak things, it only expects to be called during early sweeping. When we call it during marking, an orthogonal assertion gets confused. Let's just split the implementations: it's not enough code to worry about sharing when the usage is semantically different.
|
||
Updated•11 years ago
|
Attachment #8388783 -
Flags: review?(sphink) → review+
|
|
Assignee | |
Comment 2•11 years ago
|
||
|
||
Comment 3•11 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla30
You need to log in
before you can comment on or make changes to this bug.
Description
•