Closed Bug 755157 Opened 9 years ago Closed 9 years ago

IonMonkey: Eager compilation of jaeger/bug585310.js: Assertion failure: thing, at gc/Marking.cpp:82

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86
Linux
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: nbp, Assigned: nbp)

References

Details

Attachments

(1 file)

I am unable to reproduce this assertion locally, but it is definitively blocking the landing of IonMonkey.  I am able to reproduce a similar error with without any flag:

gczeal(2,50);
for (var j = 0; j < 100000; ++j) {
  (-0).toString();
}

As opposed to tbpl bugs, this one cause a SEGV on x64 and assert identically on x86.
Duplicate of this bug: 754714
Attached patch Fix typo.Splinter Review
Attachment #623903 - Flags: review?(dvander)
Attachment #623903 - Flags: review?(dvander) → review+
https://hg.mozilla.org/projects/ionmonkey/rev/38e41331c9ee
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.