746364 - IonMonkey: Assertion failure: (ptrBits & 0x7) == 0, at ../../jsval.h:769 or Crash [@ js::HeapPtr::operator]

Status: RESOLVED DUPLICATE of bug 754718

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on ionmonkey revision 67bf9a4a1f77 (run with --ion -n -m --ion-eager):


function range(n) {
  yield i;
}
var r = range(10);
for (var x in r)
  testLenientAndStrict (x, i++);

Comment 1

[Daniel Veditz [:dveditz]]

This assertion doesn't mean anything to me... is it bad?

Comment 2

[Christian Holler (:decoder)]

(In reply to Daniel Veditz [:dveditz] from comment #1)
> This assertion doesn't mean anything to me... is it bad?

The ptrBits assertion often indicates a memory corruption and/or gc-related problem (not specifically on the IM branch but in general).

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

See bug 743876 - this assertion has been related with an s-s issue before. (yet there's bug 728086 (gc-related though) and bug 727921)

Comment 4

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision de015aff650d).

Comment 5

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically confirmed to be still valid (reproduced on revision bc1833f2111e).

Comment 6

[Kannan Vijayan [:djvj]]

Can we reconfirm this, or provide more info on what platform it's showing up on?  Not showing up for me on OSX/64-bit.

Comment 7

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 1ac14ac50037).

Comment 8

[David Anderson [:dvander] - inactive, e-mail if emergency]

Doesn't reproduce recently, but going back to the STR rev, this is bug 754718.

Comment 9

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 754718).