738496 - IonMonkey: "Assertion failure: mutationCount == p.mutationCount,"

Status: RESOLVED DUPLICATE of bug 732845

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

The upcoming attached testcase asserts js debug shell on IonMonkey changeset c223b4370b3a with -m, -a, --ion and -n at Assertion failure: mutationCount == p.mutationCount,

The testcase in bug 732845 does not reproduce for me, hence filing this bug.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

gczeal(2, 1);
function f(n) {}
for (var i = 1; i < 99; i++) {
    f(0)
};

asserts identically on 64-bit debug shell on IonMonkey changeset 55ab6c6d276a with --ion and -n when the testcase is passed in as a CLI argument.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> asserts identically on 64-bit debug shell on IonMonkey changeset
> 55ab6c6d276a with --ion and -n when the testcase is passed in as a CLI
> argument.

Tested on Ubuntu Linux 11.10.

Comment 4

[Christian Holler (:decoder)]

The assert is known to be associated with memory corruptions, marking s-s.