797476 - "Assertion failure: addr % Cell::CellSize == 0,"

Status: RESOLVED DUPLICATE of bug 797469

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function() {
  ({
	e: (schedulegc(3)),
	l: eval(")")
  })
})()

asserts js debug shell on m-c changeset e679d2e1d02d without any CLI arguments at Assertion failure: addr % Cell::CellSize == 0,

Asserts:
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012-10-03-mozilla-central-debug/jsshell-mac64.zip

Does not assert:
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012-10-02-mozilla-central-debug/jsshell-mac64.zip

Regression window:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=c9a8f55d8541&tochange=e679d2e1d02d

s-s because this assertion tends to be scary.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

See bug 797469 but that testcase involves gczeal and evaluate but this one does not.

Comment 2

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Based on the stack, this does look like a dupe of bug 797469.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Indeed a dupe.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   109752:467aac9f380a
user:        Eddy Bruel
date:        Tue Oct 09 17:02:00 2012 +0200
summary:     Bug 797469 - Avoid putting a JSFunction in Objectbox; r=jorendorff