882082 - Assertion failure: addr % CellSize == 0, at js/src/gc/Heap.h:1032

Status: RESOLVED DUPLICATE of bug 881370

(Core :: JavaScript Engine, defect)

Description

[Panos Astithas (he/him) [:past] (please ni?)]

Attachment: Crash dump

I'm often getting these when playing with the debugger. It's not always reproducible, but it's often a combination of stepping in/over/out at:

http://htmlpad.org/debugger/

0 js::detail::HashTableEntry<js::HashMapEntry<js::AbstractFramePtr, js::RelocatablePtr<JSObject> > >::clearLive() + 63 (HashTable.h:657)
1 js::detail::HashTable<js::HashMapEntry<js::AbstractFramePtr, js::RelocatablePtr<JSObject> >, js::HashMap<js::AbstractFramePtr, js::RelocatablePtr<JSObject>, js::DefaultHasher<js::AbstractFramePtr>, js::RuntimeAllocPolicy>::MapHashPolicy, js::RuntimeAllocPolicy>::remove(js::detail::HashTableEntry<js::HashMapEntry<js::AbstractFramePtr, js::RelocatablePtr<JSObject> > >&) + 51 (HashTable.h:1217)
2 js::detail::HashTable<js::HashMapEntry<js::AbstractFramePtr, js::RelocatablePtr<JSObject> >, js::HashMap<js::AbstractFramePtr, js::RelocatablePtr<JSObject>, js::DefaultHasher<js::AbstractFramePtr>, js::RuntimeAllocPolicy>::MapHashPolicy, js::RuntimeAllocPolicy>::remove(js::detail::HashTable<js::HashMapEntry<js::AbstractFramePtr, js::RelocatablePtr<JSObject> >, js::HashMap<js::AbstractFramePtr, js::RelocatablePtr<JSObject>, js::DefaultHasher<js::AbstractFramePtr>, js::RuntimeAllocPolicy>::MapHashPolicy, js::RuntimeAllocPolicy>::Ptr) + 185 (HashTable.h:1339)
3 js::Debugger::handleBaselineOsr(JSContext*, js::StackFrame*, js::ion::BaselineFrame*) + 324 (GuardObjects.h:100)
4 js::ion::BaselineFrame::initForOsr(js::StackFrame*, unsigned int) + 886 (BaselineFrame.cpp:161)
5 js::ion::InitBaselineFrameForOsr(js::ion::BaselineFrame*, js::StackFrame*, unsigned int) + 9 (VMFunctions.cpp:821)
6   ???                           	0x00000001000f0477 0 + 4295951479

Comment 1

[Jan de Mooij [:jandem]]

This is the same stack as in bug 881370. Please reopen if the patch there does not fix this for you when it lands. Thanks!