Last Comment Bug 755157 - IonMonkey: Eager compilation of jaeger/bug585310.js: Assertion failure: thing, at gc/Marking.cpp:82
: IonMonkey: Eager compilation of jaeger/bug585310.js: Assertion failure: thing...
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86 Linux
: -- normal (vote)
: ---
Assigned To: Nicolas B. Pierron [:nbp]
:
: Jason Orendorff [:jorendorff]
Mentors:
: 743132 754714 (view as bug list)
Depends on:
Blocks: 677337
  Show dependency treegraph
 
Reported: 2012-05-14 18:37 PDT by Nicolas B. Pierron [:nbp]
Modified: 2012-05-14 23:16 PDT (History)
2 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Fix typo. (2.04 KB, patch)
2012-05-14 18:51 PDT, Nicolas B. Pierron [:nbp]
dvander: review+
Details | Diff | Splinter Review

Description Nicolas B. Pierron [:nbp] 2012-05-14 18:37:25 PDT
I am unable to reproduce this assertion locally, but it is definitively blocking the landing of IonMonkey.  I am able to reproduce a similar error with without any flag:

gczeal(2,50);
for (var j = 0; j < 100000; ++j) {
  (-0).toString();
}

As opposed to tbpl bugs, this one cause a SEGV on x64 and assert identically on x86.
Comment 1 Nicolas B. Pierron [:nbp] 2012-05-14 18:47:52 PDT
*** Bug 754714 has been marked as a duplicate of this bug. ***
Comment 2 Nicolas B. Pierron [:nbp] 2012-05-14 18:51:52 PDT
Created attachment 623903 [details] [diff] [review]
Fix typo.
Comment 3 David Anderson [:dvander] 2012-05-14 18:54:20 PDT
*** Bug 743132 has been marked as a duplicate of this bug. ***
Comment 4 Nicolas B. Pierron [:nbp] 2012-05-14 23:16:40 PDT
https://hg.mozilla.org/projects/ionmonkey/rev/38e41331c9ee

Note You need to log in before you can comment on or make changes to this bug.