IonMonkey: Eager compilation of jaeger/bug585310.js: Assertion failure: thing, at gc/Marking.cpp:82

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: nbp, Assigned: nbp)

Tracking

Other Branch
x86
Linux
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

5 years ago
I am unable to reproduce this assertion locally, but it is definitively blocking the landing of IonMonkey.  I am able to reproduce a similar error with without any flag:

gczeal(2,50);
for (var j = 0; j < 100000; ++j) {
  (-0).toString();
}

As opposed to tbpl bugs, this one cause a SEGV on x64 and assert identically on x86.
(Assignee)

Updated

5 years ago
Duplicate of this bug: 754714
(Assignee)

Comment 2

5 years ago
Created attachment 623903 [details] [diff] [review]
Fix typo.
Attachment #623903 - Flags: review?(dvander)
Attachment #623903 - Flags: review?(dvander) → review+
Duplicate of this bug: 743132
(Assignee)

Comment 4

5 years ago
https://hg.mozilla.org/projects/ionmonkey/rev/38e41331c9ee
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.