738846 - "Assertion failure: addr % Cell::CellSize == 0,"

Status: RESOLVED DUPLICATE of bug 738841

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

try {
    (function() {
        var m
        ArrayBuffer()
        var _ = t
        var _2 = []
    }())
} catch (e) {}
try {
    for (y in [schedulegc(58)]) {
        m
    }
} catch (e) {}
try {
    (function() {
        n.(O)
    }())
} catch (e) {}
try {
    (function() {
        s
    }())
} catch (e) {}
try {
    e
} catch (e) {}
try {
    "" ()
} catch (e) {}
try {
    gc()
    s
} catch (e) {}
try {
    (function() {
        for (v of m) {}
    }())
} catch (e) {}
try {
    t
} catch (e) {}
try {
    (function() {
        "use strict";
        print(new function() {
            r
        }(this))
    }())
} catch (e) {}

asserts 64-bit js debug shell on m-c changeset 6470fe2fc4de with -m and -a at Assertion failure: addr % Cell::CellSize == 0,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   87736:fbef6a165cf8
user:        Bill McCloskey
date:        Fri Feb 10 18:32:08 2012 -0800
summary:     Bug 723313 - Stop using conservative stack scanner for VM stack marking (r=luke,bhackett)

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

s-s because gc is on the stack.

Tested with passing the testcase in as a CLI argument.

Related to bug 738841?