798946 - IonMonkey: Assertion failure: [infer failure] Missing type pushed 0: float, at jsinfer.cpp:311

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision ecd4c4304219 (run with --ion-eager):


function RandBool() { var x = Math.random() >= 0.5; return x; }
var CHARS = "aaa";
function RandStr() {
  var c = Math.floor(Math.random() * CHARS.length);
}
function RandVal() { 
  return RandBool() ? RandStr() : RandStr(); 
}
function GenerateSpecPermutes(matchVals, resultArray) {
    var maxPermuteBody = (1 << matchVals.length) - 1;
    for(var bod_pm = 0; bod_pm <= maxPermuteBody; bod_pm++)
      for(var k = 0; k < matchVals.length; k++)
        var body = ((bod_pm & (1 << k)) > 0) ? null : RandVal();
}
GenerateSpecPermutes(["foo", "bar", "zing"]);

Comment 1

[Christian Holler (:decoder)]

S-s due to infer failure, CCing IonMonkey team.

Comment 2

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically confirmed to be still valid (reproduced on revision aa5e3b445810).
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   109435:64bf5f240ccb
user:        Sean Stangl
date:        Fri Oct 05 12:05:21 2012 -0700
summary:     Bug 797551 - Use callWithABI() for Math.random(). r=dvander

This iteration took 100.125 seconds to run.

Comment 3

[Sean Stangl [:sstangl]]

Attachment: Confer with TI about the return type of Math.random().

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 797551
User impact if declined: Unlikely crashes
Testing completed (on m-c, etc.): on m-i
Risk to taking this patch (and alternatives if risky): none
String or UUID changes made by this patch: none

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Setting flags based on regression range.

Comment 5

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 669732 [details] [diff] [review]
Confer with TI about the return type of Math.random().

Review of attachment 669732 [details] [diff] [review]:
-----------------------------------------------------------------

r=me with the test case included, if possible

Comment 6

[Alex Keybl [:akeybl]]

Comment on attachment 669732 [details] [diff] [review]
Confer with TI about the return type of Math.random().

Please refrain from nominating for uplift before landing on m-c.

Comment 7

[Sean Stangl [:sstangl]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/315e66e6b2ae

Comment 8

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/315e66e6b2ae

Comment 9

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 10

[Sean Stangl [:sstangl]]

Comment on attachment 669732 [details] [diff] [review]
Confer with TI about the return type of Math.random().

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 797551
User impact if declined: Unlikely crashes
Testing completed (on m-c, etc.): on m-i
Risk to taking this patch (and alternatives if risky): none
String or UUID changes made by this patch: none

Comment 11

[bhavana bajaj [:bajaj]]

Comment on attachment 669732 [details] [diff] [review]
Confer with TI about the return type of Math.random().

Approving the patch on aurora as the fix will avoid unlikely crashes and is low risk .

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/dbcf23129506