858209 - Assertion failure: obj, at ./dist/include/js/Value.h:482 with OOM

Status: RESOLVED DUPLICATE of bug 840012

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision c232bec6974d (no options required):


var gTestcases = new Array();
var gTc = gTestcases.length;
function TestCase(n, d, e, a)
  gTestcases[gTc++] = this;
try {} catch(ex) {}
gcPreserveCode()
gcparam("maxBytes", gcparam("gcBytes") + 4*1024);
for ( CHARCODE = 0; CHARCODE < 256; CHARCODE++ )
  new TestCase();

Comment 1

[Christian Holler (:decoder)]

This could be an old bug, but it would be nice to get it fixed since it triggers quite often.

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   95790:b863ef9946b8
user:        Luke Wagner
date:        Thu Feb 23 13:59:10 2012 -0800
summary:     Bug 659577 - Don't alias stack variables (r=bhackett)

This iteration took 80.333 seconds to run.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 25c2aaee8acc).

Comment 4

[Christian Holler (:decoder)]

Likely fixed by bug 840012.

Comment 5

[Christian Holler (:decoder)]

JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   129087:64198b55d1ae
user:        Luke Wagner
date:        Wed Apr 17 08:50:54 2013 -0700
summary:     Bug 840012 - Handle OOM in CreateThisForFunction (r=hannes)

This iteration took 131.166 seconds to run.