Closed
Bug 854418
Opened 11 years ago
Closed 11 years ago
IonMonkey: Assertion failure: [infer failure] Missing type pushed 0: float, at jsinfer.cpp:316
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: decoder, Unassigned)
References
Details
(Keywords: assertion, sec-high, testcase, Whiteboard: [jsbugmon:])
Attachments
(1 file)
|
1.86 KB,
application/javascript
|
Details |
The attached testcase asserts on mozilla-central revision 3acbf951b3b1 (run with --ion-eager).
|
Reporter | |
Comment 1•11 years ago
|
||
Very fragile test, will try to bisect but not sure if that will work. Marked s-s because infer failures can be critical and the test uses gczeal.
Blocks: IonFuzz
Whiteboard: [jsbugmon:update,bisect]
|
|
Reporter | |
Updated•11 years ago
|
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:bisect]
|
|
Reporter | |
Comment 3•11 years ago
|
||
JSBugMon: Cannot process bug: Error: Failed to compile specified revision 3acbf951b3b1 (maybe try another?)
|
|
Reporter | |
Updated•11 years ago
|
Whiteboard: [jsbugmon:bisect] → [jsbugmon:]
|
|
Reporter | |
Comment 4•11 years ago
|
||
JSBugMon: Bisection requested, failed due to error: Error: Failed to compile specified revision 3acbf951b3b1 (maybe try another?)
|
||
Comment 5•11 years ago
|
||
It looks like bisection failed, as predicted. Is there anything else that you can do here decoder? Failing that, could some IonMonkey person look into this?
|
||
Comment 6•11 years ago
|
||
I'm going to close this as WFM. The test was fragile and I can't reproduce this issue, but more importantly TI has been more-or-less completely rewritten over the past 6 months (bug 804676 and others). Furthermore, this "Missing type pushed" message is also gone.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → WORKSFORME
|
||
Updated•9 years ago
|
Group: core-security → core-security-release
|
||
Updated•7 years ago
|
Group: core-security-release
You need to log in
before you can comment on or make changes to this bug.
Description
•