Closed Bug 921263 Opened 10 years ago Closed 10 years ago

Assertion failure: addr % CellSize == 0, at ../../gc/Heap.h:1054 or Crash [@ JSString::isRope] with backtracking allocator

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: decoder, Unassigned)

References

Details

(Keywords: assertion, crash, testcase) 

The following testcase asserts on mozilla-central revision e85b0372cece (threadsafe build, run with --ion-eager ----ion-regalloc=backtracking):


function runTestCase(testcase) {}
function crash() {
  for (var i = 0; i < 0x4001; ++i) {
    var si = String(i);
    runTestCase[i] = [ "y" + si, + si ];
  }
}
crash();
Only reproduces with --ion-regalloc=backtracking so I assume it's not critical.
Keywords: crash
Blocks: 826741
This may have been introduced by the fix for bug 875656, which is now backed out.
decoder, perhaps you could retest this in lieu of comment 2?
Flags: needinfo?(choller)
Thanks!
Flags: needinfo?(choller)
Please stop cancelling need-info and spamming bugs.
Flags: needinfo?(choller)
Yup, doesn't crash anymore. Marking as WFM.
Status: NEW → RESOLVED
Closed: 10 years ago
Flags: needinfo?(choller)
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.