Closed Bug 843444 Opened 10 years ago Closed 10 years ago

BaselineCompiler: "Assertion failure: thing," or Crash [@ js::gc::Cell::zone] or [@ MarkInternal]

Categories

(Core :: JavaScript Engine, defect)

Other Branch
All
macOS
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 842430

People

(Reporter: gkw, Unassigned)

References

(Blocks 1 open bug)

Details

(4 keywords, Whiteboard: [jsbugmon:update,ignore])

Crash Data

Attachments

(1 file)

Attached file stack
gczeal(8, 1)
function recurse() {
    recurse()
};
this.watch(5, (function () {}))
recurse()

asserts js debug shell on ionmonkey changeset 2445c6378f36 without any CLI arguments at Assertion failure: thing, and crashes js opt shell at js::gc::Cell::zone with MarkInternal on the stack.
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   122305:1c8552cc6ec4
user:        Brian Hackett
date:        Mon Feb 18 05:51:17 2013 -0700
summary:     Bug 836466 - Lower default Ion usesBeforeCompile from 10240 to 1000, r=jandem.

Is bug 836466 a likely regressor here?
Blocks: 836466
Flags: needinfo?(bhackett1024)
Crash Signature: [@ js::gc::Cell::zone] [@ MarkInternal] → [@ js::gc::Cell::zone] [@ MarkInternal]
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 633881bda24b).
JSBugMon is right, this was fixed by bug 842430.

I added the testcase:

https://hg.mozilla.org/projects/ionmonkey/rev/c4839ef2f629

(Modified a bit so that it runs faster, but it still fails with --ion-eager on an earlier revision.)
Status: NEW → RESOLVED
Crash Signature: [@ js::gc::Cell::zone] [@ MarkInternal] → [@ js::gc::Cell::zone] [@ MarkInternal]
Closed: 10 years ago
Flags: needinfo?(bhackett1024)
Resolution: --- → DUPLICATE
Duplicate of bug: 842430
You need to log in before you can comment on or make changes to this bug.