1120151 - "Assertion failure: uintptr_t(str) > 0x1000" with gcparam("maxBytes") and RegExp.prototype.flags

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Attachment: stack

gcparam('maxBytes', gcparam('gcBytes') + 0); (/c/m).flags;

js_ReportOutOfMemory called
Assertion failure: uintptr_t(str) > 0x1000, at ../../../dist/include/js/Value.h:734

> ~/fuzzing/autobisect-js/autoBisect.py --build="--enable-more-deterministic --enable-debug" -p "--fuzzing-safe --no-threads ~/Desktop/h.js"

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/bc5ad20e8f27
user:        ziyunfei
date:        Mon Dec 08 19:41:00 2014 -0500
summary:     Bug 1108467 - Implement RegExp.prototype.flags. r=till

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/f2dcbff898a1
user:        ziyunfei
date:        Sun Feb 22 07:23:00 2015 +0100
summary:     Bug 1120170 - part 2 - Self-host RegExp.prototype.flags. r=till

Till, is bug 1120170 a likely fix?

Comment 2

[Till Schneidereit [:till]]

Yes, very much so.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

-> FIXED by bug 1120170.