817365 - "Assertion failure: slot < numFixedSlots(),"

Status: RESOLVED DUPLICATE of bug 817002

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: partially reduced testcase

+++ This bug was initially created as a clone of Bug #817002 +++

The attached testcase asserts js debug shell on m-c changeset abb39d1df815 without any CLI arguments at Assertion failure: slot < numFixedSlots(),

https://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012-11-30-mozilla-central-debug/jsshell-mac64.zip

Happens everytime. s-s because gc is on the stack.


Stack:

Assertion failure: slot < numFixedSlots(), at ../../../js/src/vm/ObjectImpl.h:1243

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000000
0x000000010016540f in js::ArrayBufferObject::obj_trace ()
(gdb) bt
#0  0x000000010016540f in js::ArrayBufferObject::obj_trace ()
#1  0x0000000100208e8c in js::ObjectImpl::markChildren ()
#2  0x0000000100099623 in IncrementalCollectSlice ()
#3  0x0000000100098cfe in GCCycle ()
#4  0x0000000100097e1c in Collect ()
#5  0x00000001000654d6 in js::DestroyContext ()
#6  0x0000000100002ecf in main ()
(gdb)

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I really think this is bug 817002, so duping. Please undupe if it's incorrect.