Closed Bug 807913 Opened 7 years ago Closed 7 years ago

"Assertion failure: *ptr == 0x3D,"

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 808067
Tracking Status
firefox16 --- unaffected
firefox17 --- unaffected
firefox18 --- unaffected
firefox19 --- affected
firefox-esr10 --- unaffected
firefox-esr17 --- unaffected

People

(Reporter: gkw, Assigned: billm)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])

Attachments

(1 file)

Attached file stack
gc()
function f() {
  for (i = 0; i < 99; ++i)
  x = {
	a: NaN
  }
}
gcslice(6)
gc()
f()
verifyprebarriers()

asserts js debug shell on m-c changeset 556b9cfb269f with --no-jm at Assertion failure: *ptr == 0x3D,

s-s because this involves gc, assuming sec-critical.
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   112050:23eb7d58bf90
user:        Bill McCloskey
date:        Thu Nov 01 08:08:21 2012 -0700
summary:     Bug 807535 - Avoid toggling Ion write barrier too often (r=sstangl)

This iteration took 105.812 seconds to run.
Bill, this points to a changeset by you. Do you mind taking a look at it please?
status-firefox18 should be changed to affected if bug 807535 lands on mozilla-aurora.
Assignee: general → wmccloskey
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 808067
Clearing tracking due to this being a dupe.
No longer blocks: 807535
Depends on: 808067
No longer depends on: 808067
Group: core-security
You need to log in before you can comment on or make changes to this bug.