793385 - Assertion failure: addr % Cell::CellSize == 0, at ../../gc/Heap.h:846 with OOM

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision e4757379b99a (run with --ion-eager):


gcparam("maxBytes", gcparam("gcBytes") + 4*1024);
function f() {
    var inner4 = f("get"),
	x1,x2,x3,x4,x5,x11,x12,x13,x14,x15,x16,x17,x18,
        otherGlobalSameCompartment = newGlobal("same-compartment");
    eval('');
}
assertEq("aaa".replace(/a/g, f()), "poniesponiesponies");

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

This isn't an Ion bug but needs to be fixed anyway.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b01c3760fce6

Comment 4

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/b01c3760fce6

Comment 5

[Daniel Veditz [:dveditz]]

How far back does this bug go? Do we need it in ESR10 or Firefox 17?

Comment 6

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 7

[David Anderson [:dvander] - inactive, e-mail if emergency]

(In reply to Daniel Veditz [:dveditz] from comment #5)
> How far back does this bug go? Do we need it in ESR10 or Firefox 17?

This bug is only in Firefox 18.