684084 - Assertion failure: fe->isType(type), at methodjit/Compiler.cpp:7024

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision fcca99426576 (run with -m -n -a), tested on 64 bit:


function Integer( value, exception ) {
  try {  } catch ( e ) {  }
  new (value = this)( this.value );
  if ( Math.floor(value) != value || isNaN(value) ) {  }
}
new Integer( 3, false );

Comment 1

[Brian Hackett [Laid off!]]

Attachment: patch

For JSOP_THIS in scripts which have not yet had a 'this' value assigned (we are using '-a' and the script has never run), the inferred type set for the value pushed by the op is empty but the compiler still marked it as a double, breaking the invariant that compiler types reflect inferred types.

Comment 2

[Brian Hackett [Laid off!]]

http://hg.mozilla.org/projects/jaegermonkey/rev/77e9502bd20f

Comment 3

[Christian Holler (:decoder)]

Is this really fully fixed? I have another test involving "this" and the same assertion:

function Function() {
    try {
    var g = this;
    g.c("evil", eval);
    } catch(b) {}
}
var o0 = Function.prototype;
var f = new Function( (null ) );


This works on jaegermonkey revision fc5a768a97b5 (which should include your fix already if I'm not mistaken). Also works on m-c, requires options -m -n -a. If this is not the same bug, let me know.

Comment 4

[Brian Hackett [Laid off!]]

The second testcase is a different, though somewhat related issue.  When generating inline code to construct the 'this' value for scripts called with 'new', the compiler could inadvertently update the known 'this' types of the script if the script had never actually been called with 'new' before.  Type sets should never change during compilation (they do if we detect a static integer overflow, but doing this forces compilation to restart).

http://hg.mozilla.org/projects/jaegermonkey/rev/7db908db3669

Comment 5

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/mozilla-central/rev/c943bbf9dac4

Comment 6

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug684084-2.js.