757810 - IonMonkey: Assertion failure: IsMarkedOrAllocated(static_cast<Cell *>(thing)), at jsgc.cpp:4444

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on ionmonkey revision d5545e6d927b (run with --ion -n -m):


var gTestcases = new Array();
function TestCase(n, d, e, a)
  gTestcases[gTc++] = this;
TestCase.prototype.dump = function () {
    dump('\njstest: ' + this.path + ' ' +
         'reason: '      + toPrinted(this.reason) + '\n');
};
function toPrinted(value) {}
    dump = (function () {});
  for ( gTc=0; gTc < gTestcases.length; gTc++ ) {
  }
function jsTestDriverEnd()
{
  for (var i = 0; i < gTestcases.length; i++)
    gTestcases[i].dump();
}
function Integer( value, exception ) {
  new TestCase(
    this.value );
}
new TestCase( 3, false );
new Integer( NaN, true );
new Integer( 0, false );
new Integer( Infinity, false );
new Integer( -2.12, true );
new Integer( Math.LN2, true );
jsTestDriverEnd();
jsTestDriverEnd();
jsTestDriverEnd();
jsTestDriverEnd();
jsTestDriverEnd();
jsTestDriverEnd();
jsTestDriverEnd();
gczeal(4);

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Bill recommends holding off on this until bug 746691 lands, which is very likely to fix this.

Comment 2

[Christian Holler (:decoder)]

Fyi, with jandem's patch making this assertion more verbose, the assert is:

[LangFuzz] Issue Report: Assertion failure: [verifier failure] constant, at jsgc.cpp:4457

I got the same assertion for other values than "constant", and I'll file those separately now. Worst case, they are dups and we can just close them when this one is fixed :)

Comment 3

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 80a444262772).

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Fixed by bug 746691.

Comment 5

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 6

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 7

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.