The following testcase asserts on mozilla-central revision ab4ccf3d6b60 (run with --fuzzing-safe --ion-eager): gcparam("maxBytes", gcparam("gcBytes") + 4*1024); function A(a) { this.a = a; } function B(b) { this.b = b; } function C(c) { this.c = c; } function makeArray(n) { var classes = [A, B, C]; var arr = []; for (var i = 0; i < n; i++) { arr.push(new classes[i % 3](i % 3)); } } var arr = makeArray(30000);

Just hit this OOM error again and since the other isExceptionPending assertion has been fixed, this must be something new.

JSBugMon: Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/67e44e98555c user: Hannes Verschore date: Fri Jan 04 17:11:32 2013 +0100 summary: Bug 825705: Creating this on caller-side shouldn't query prototype for unknown objects, r=jandem This iteration took 124.057 seconds to run.

Hannes, can you look at this one?

Kannan, can you have a look? I think we have an pending exception in the parent before inlining. At least I see no reason why that wouldn't be possible. So this assert needs to get deleted, maybe handled like the check you introduced after inlining?

(In reply to Christian Holler (:decoder) from comment #4) > Hannes, can you look at this one? Sorry about the delay in checking this, but was on Holiday...

JSBugMon: The testcase found in this bug no longer reproduces (tried revision ddd03c32fab1).

Is it normal it takes so long to bisect the range to find the fix?

JSBugMon: Fix Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first good revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/f613d7363bd2 user: Brian Hackett date: Mon Oct 14 12:13:41 2013 -0600 summary: Bug 924611 - Don't create lazy type objects and type properties in IonBuilder, r=jandem. This iteration took 417.636 seconds to run.

Brian: do you think this could have solved this issue? I don't see a change that could be linked with the introduction of the bug. Or do you think this has only hidden the problem?

Yeah, since IonBuilder doesn't use a cx anymore except for limited cases in the definite properties analysis it doesn't create many exceptions anymore.