Closed
Bug 985732
Opened 11 years ago
Closed 11 years ago
GenerationalGC: Assertion failure: nDynamicSlots < Nursery::MaxNurserySlots, at jit/IonMacroAssembler.cpp:683
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 969012
People
(Reporter: decoder, Unassigned)
References
Details
(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update,bisect,ignore])
Attachments
(1 file)
|
(deleted),
application/javascript
|
Details |
The attached testcase asserts on mozilla-central built with --enable-exact-rooting --enable-gcgenerational, revision 3bc3b9e2cd99 (run with --fuzzing-safe --ion-check-range-analysis --ion-eager).
|
||
Comment 1•11 years ago
|
||
Great find! I didn't think this case was possible. Sadly the regressing bug, bug 969012, got backed out this morning. I'll fix this locally before relanding, but for now you should just pull tip.
Status: NEW → ASSIGNED
|
Reporter | |
Comment 2•11 years ago
|
||
I've pulled mozilla-central tip (e84a391b604b) and still hit that with the fuzzer.
Flags: needinfo?(terrence)
Flags: needinfo?(jcoppeard)
|
|
Reporter | |
Updated•11 years ago
|
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update,bisect,ignore]
|
|
Reporter | |
Comment 3•11 years ago
|
||
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 358d369c8388).
|
||
Updated•11 years ago
|
Flags: needinfo?(jcoppeard)
|
|
||
Comment 5•11 years ago
|
||
Added the test from this bug when relanding in bug 969012.
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•