843444 - BaselineCompiler: "Assertion failure: thing," or Crash [@ js::gc::Cell::zone] or [@ MarkInternal]

Status: RESOLVED DUPLICATE of bug 842430

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

gczeal(8, 1)
function recurse() {
    recurse()
};
this.watch(5, (function () {}))
recurse()

asserts js debug shell on ionmonkey changeset 2445c6378f36 without any CLI arguments at Assertion failure: thing, and crashes js opt shell at js::gc::Cell::zone with MarkInternal on the stack.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   122305:1c8552cc6ec4
user:        Brian Hackett
date:        Mon Feb 18 05:51:17 2013 -0700
summary:     Bug 836466 - Lower default Ion usesBeforeCompile from 10240 to 1000, r=jandem.

Is bug 836466 a likely regressor here?

Comment 2

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 633881bda24b).

Comment 3

[Jan de Mooij [:jandem]]

JSBugMon is right, this was fixed by bug 842430.

I added the testcase:

https://hg.mozilla.org/projects/ionmonkey/rev/c4839ef2f629

(Modified a bit so that it runs faster, but it still fails with --ion-eager on an earlier revision.)