Closed
Bug 921263
Opened 11 years ago
Closed 11 years ago
Assertion failure: addr % CellSize == 0, at ../../gc/Heap.h:1054 or Crash [@ JSString::isRope] with backtracking allocator
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: decoder, Unassigned)
References
Details
(Keywords: assertion, crash, testcase)
The following testcase asserts on mozilla-central revision e85b0372cece (threadsafe build, run with --ion-eager ----ion-regalloc=backtracking):
function runTestCase(testcase) {}
function crash() {
for (var i = 0; i < 0x4001; ++i) {
var si = String(i);
runTestCase[i] = [ "y" + si, + si ];
}
}
crash();
Reporter | ||
Comment 1•11 years ago
|
||
Only reproduces with --ion-regalloc=backtracking so I assume it's not critical.
Keywords: crash
Comment 2•11 years ago
|
||
This may have been introduced by the fix for bug 875656, which is now backed out.
Comment 3•11 years ago
|
||
decoder, perhaps you could retest this in lieu of comment 2?
Flags: needinfo?(choller)
Comment 5•11 years ago
|
||
Please stop cancelling need-info and spamming bugs.
Flags: needinfo?(choller)
Reporter | ||
Comment 6•11 years ago
|
||
Yup, doesn't crash anymore. Marking as WFM.
Status: NEW → RESOLVED
Closed: 11 years ago
Flags: needinfo?(choller)
Resolution: --- → WORKSFORME
You need to log in
before you can comment on or make changes to this bug.
Description
•