807913 - "Assertion failure: *ptr == 0x3D,"

Status: RESOLVED DUPLICATE of bug 808067

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

gc()
function f() {
  for (i = 0; i < 99; ++i)
  x = {
	a: NaN
  }
}
gcslice(6)
gc()
f()
verifyprebarriers()

asserts js debug shell on m-c changeset 556b9cfb269f with --no-jm at Assertion failure: *ptr == 0x3D,

s-s because this involves gc, assuming sec-critical.

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   112050:23eb7d58bf90
user:        Bill McCloskey
date:        Thu Nov 01 08:08:21 2012 -0700
summary:     Bug 807535 - Avoid toggling Ion write barrier too often (r=sstangl)

This iteration took 105.812 seconds to run.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Bill, this points to a changeset by you. Do you mind taking a look at it please?

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

status-firefox18 should be changed to affected if bug 807535 lands on mozilla-aurora.

Comment 5

[Andrew McCreight [:mccr8]]

Clearing tracking due to this being a dupe.