Closed Bug 738846 Opened 12 years ago Closed 12 years ago

"Assertion failure: addr % Cell::CellSize == 0,"

Categories

(Core :: JavaScript Engine, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 738841

People

(Reporter: gkw, Assigned: billm)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: js-triage-needed)

Attachments

(1 file)

Attached file stack
try {
    (function() {
        var m
        ArrayBuffer()
        var _ = t
        var _2 = []
    }())
} catch (e) {}
try {
    for (y in [schedulegc(58)]) {
        m
    }
} catch (e) {}
try {
    (function() {
        n.(O)
    }())
} catch (e) {}
try {
    (function() {
        s
    }())
} catch (e) {}
try {
    e
} catch (e) {}
try {
    "" ()
} catch (e) {}
try {
    gc()
    s
} catch (e) {}
try {
    (function() {
        for (v of m) {}
    }())
} catch (e) {}
try {
    t
} catch (e) {}
try {
    (function() {
        "use strict";
        print(new function() {
            r
        }(this))
    }())
} catch (e) {}

asserts 64-bit js debug shell on m-c changeset 6470fe2fc4de with -m and -a at Assertion failure: addr % Cell::CellSize == 0,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   87736:fbef6a165cf8
user:        Bill McCloskey
date:        Fri Feb 10 18:32:08 2012 -0800
summary:     Bug 723313 - Stop using conservative stack scanner for VM stack marking (r=luke,bhackett)
Group: core-security
s-s because gc is on the stack.

Tested with passing the testcase in as a CLI argument.

Related to bug 738841?
Assignee: general → wmccloskey
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
Group: core-security
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: