921263 - Assertion failure: addr % CellSize == 0, at ../../gc/Heap.h:1054 or Crash [@ JSString::isRope] with backtracking allocator

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision e85b0372cece (threadsafe build, run with --ion-eager ----ion-regalloc=backtracking):


function runTestCase(testcase) {}
function crash() {
  for (var i = 0; i < 0x4001; ++i) {
    var si = String(i);
    runTestCase[i] = [ "y" + si, + si ];
  }
}
crash();

Comment 1

[Christian Holler (:decoder)]

Only reproduces with --ion-regalloc=backtracking so I assume it's not critical.

Comment 2

[Dan Gohman [:sunfish]]

This may have been introduced by the fix for bug 875656, which is now backed out.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

decoder, perhaps you could retest this in lieu of comment 2?

Comment 4

[Kyle Wooten]

Thanks!

Comment 5

[Aaron Train [:aaronmt]]

Please stop cancelling need-info and spamming bugs.

Comment 6

[Christian Holler (:decoder)]

Yup, doesn't crash anymore. Marking as WFM.