The following testcase asserts on mozilla-central built with --enable-exact-rooting --enable-gcgenerational, revision cf485c48b52f (run with --fuzzing-safe --ion-check-range-analysis): function compareSource(expect, actual, summary) replace(/new (\w+)\s*\(\s*\)/mg, 'new $1'); var lfcode = new Array(); lfcode.push(""); lfcode.push("0"); lfcode.push("\ var gTestcases = new Array();\ var setterCalled = false ;\ function TestCase() {}\ Array.prototype.__defineSetter__((2), function() { setterCalled = true; });\ for(var i = 0; i < 20; ++i) {\ var testcase = new TestCase();\ }\ ( \"ABCDEFGHIJK\" ) (setterCalled, true);\ "); lfcode.push("\ var recursiveFunctions = [{}];\ (function testAllRecursiveFunctions() {\ for (var [propertyIsEnumerable, gc] = 0 ; i < 0; ++i) \ eval() \ })();\ gcslice(2868);\ "); lfcode.push("var f = new Float64Array([0, 0]); var u = new Uint32Array(f.buffer);"); while (true) { var file = lfcode.shift(); if (file == undefined) { break; } loadFile(file) } function loadFile(lfVarx) { try { if (lfVarx.substr(-3) != ".js" && lfVarx.length != 1) { switch (lfRunTypeId) { default: evaluate(lfVarx); break; } } else if (!isNaN(lfVarx)) { lfRunTypeId = parseInt(lfVarx); } } catch (lfVare) { } }

JSBugMon: Cannot process bug: Unknown exception (check manually)

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Reproduced at original changeset with following output: Assertion failure: !(*thingp)->arenaHeader()->allocatedDuringIncremental, at /home/jon/work/rooting/js/src/gc/Marking.cpp:364 Catchpoint 1 (signal SIGSEGV), js::gc::IsAboutToBeFinalized<js::ArrayBufferViewObject> (thingp=0x7fffffffe1b0) at /home/jon/work/rooting/js/src/gc/Marking.cpp:364 364 JS_ASSERT(!(*thingp)->arenaHeader()->allocatedDuringIncremental); This has been fixed by bug 986147.