844482 - IonMonkey: Assertion failure: ion::IsEnabled(cx), at ion/Ion.cpp:1375 or Crash [@ add]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision e162098b76d9 (run with --ion-eager):


var SECTION = "";
function TestCase(n, d, e, a) {
  this.name = n;
  this.description = d;
  this.expect = e;
  !document.location.href.match(/jsreftest.html/)
}
var lfcode = new Array();
lfcode.push("gcparam(\"maxBytes\", gcparam(\"gcBytes\") + 4*1024);\n");
lfcode.push("  return -((new Date(2000, 1, 1)).getTimezoneOffset())/60;\n");
lfcode.push("\
	gczeal(4);\
	new TestCase(SECTION, eval(\"Number.prototype.toString()\") );\
");
    delete Debugger;
while (true) {
	var file = lfcode.shift(); if (file == undefined) { break; }
        loadFile(file)
}
function loadFile(lfVarx) {
    try {
	lfVarx.substr(-3) 
            lfRunTypeId = parseInt(lfVarx);
            switch (lfRunTypeId) {
                default: function newFunc(x) { new Function(x)(); }; newFunc(lfVarx); break;
	}
    } catch (lfVare) {    }
}

Comment 1

[Christian Holler (:decoder)]

This is an OOM issue, but it seems to cause multiple signatures, including a barrier verifier assert, so it would be good to get this fixed.

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   119272:7b531a62b114
user:        Brian Hackett
date:        Fri Jan 18 09:23:28 2013 -0700
summary:     Bug 772820 - Disallow GCs during script analysis or compilation, r=billm.

This iteration took 101.029 seconds to run.

Comment 3

[Christian Holler (:decoder)]

Needinfo on Brian based on comment 2 :)

Comment 4

[Brian Hackett [Laid off!]]

Attachment: patch

Blame is wrong, this is a preexisting issue (bug 772820 affects when we OOM).

Comment 5

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e6f94804e6a7

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/e6f94804e6a7