"Assertion failure: addr % Cell::CellSize == 0,"

RESOLVED DUPLICATE of bug 797469

Status

()

--
critical
RESOLVED DUPLICATE of bug 797469
6 years ago
5 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
x86_64
Mac OS X
assertion, regression, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update] dupe of bug 797469)

(Reporter)

Description

6 years ago
(function() {
  ({
	e: (schedulegc(3)),
	l: eval(")")
  })
})()

asserts js debug shell on m-c changeset e679d2e1d02d without any CLI arguments at Assertion failure: addr % Cell::CellSize == 0,

Asserts:
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012-10-03-mozilla-central-debug/jsshell-mac64.zip

Does not assert:
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012-10-02-mozilla-central-debug/jsshell-mac64.zip

Regression window:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=c9a8f55d8541&tochange=e679d2e1d02d

s-s because this assertion tends to be scary.
(Reporter)

Comment 1

6 years ago
See bug 797469 but that testcase involves gczeal and evaluate but this one does not.
Based on the stack, this does look like a dupe of bug 797469.
Whiteboard: [jsbugmon:update] → [jsbugmon:update] dupe of bug 797469?
(Reporter)

Comment 3

6 years ago
Indeed a dupe.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   109752:467aac9f380a
user:        Eddy Bruel
date:        Tue Oct 09 17:02:00 2012 +0200
summary:     Bug 797469 - Avoid putting a JSFunction in Objectbox; r=jorendorff
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → DUPLICATE
Whiteboard: [jsbugmon:update] dupe of bug 797469? → [jsbugmon:update] dupe of bug 797469
Duplicate of bug: 797469
Group: core-security
You need to log in before you can comment on or make changes to this bug.