799178 - Assertion failure: addr % Cell::CellSize == 0, at ../../gc/Heap.h:846 with OOM

Status: RESOLVED DUPLICATE of bug 797469

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 70337fa2fe62 (no options required):


var lfcode = new Array();
lfcode.push("gcparam(\"maxBytes\", gcparam(\"gcBytes\") + 1024);");
lfcode.push("if (!deepEqual(a[prop], b[prop]))");
while (true) {
  var file = lfcode.shift(); if (file == undefined) { break; }
  loadFile(file)
}
function loadFile(lfVarx) {
  eval(lfVarx);
}

Comment 1

[Christian Holler (:decoder)]

Although this is an out-of-memory condition, it still showed a crash and the CellSize assertion which is known to be security relevant. Not sure if this is IonMonkey-related, Ccing devs.

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   108900:ef321673c843
user:        Eddy Bruel
date:        Tue Oct 02 14:56:26 2012 +0200
summary:     Bug 795721 - Inherit FunctionBox from ObjectBox; r=njn

This iteration took 7.058 seconds to run.

Comment 3

[Christian Holler (:decoder)]

Likely a dup of bug 797469 then, waiting for that to land.

Comment 4

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 5cca0408a73f).