Closed
Bug 1055015
Opened 10 years ago
Closed 10 years ago
Assertion failure: false (MOZ_ASSERT_UNREACHABLE: ToInt32 invalid input type), at jit/Lowering.cpp:1871 with Symbol
Categories
(Core :: JavaScript Engine: JIT, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 1054753
Tracking | Status | |
---|---|---|
firefox34 | --- | affected |
People
(Reporter: decoder, Unassigned)
References
Details
(Keywords: assertion, testcase, Whiteboard: [jsbugmon:])
Attachments
(1 file)
467 bytes,
text/plain
|
Details |
The following testcase asserts on mozilla-central revision 0aaa2d3d15cc (run with --no-threads --fuzzing-safe --ion-eager):
var x = Symbol.for("x");
function f(code) {
code = code.replace(/\/\*DUPTRY\d+\*\//, function(k) {
n = parseInt(k.substr(8), (null ));
return g("try{}catch(e){}", n)
});
}
function g(s, n) {
s2 = s + s
r = n % 2
m = g(s2, x)
}
f("switch(''){default:break;/*DUPTRY525*/}")
Reporter | ||
Comment 1•10 years ago
|
||
Reporter | ||
Comment 2•10 years ago
|
||
Also aborts in the same way in release builds, but marking s-s because I don't know if this can be avoided and something else (bad) could happen.
Needinfo from Jason because this involves "Symbol".
Reporter | ||
Updated•10 years ago
|
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
Reporter | ||
Comment 3•10 years ago
|
||
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/8e4e04daf2a6
user: 446240525@qq.com, Jason Orendorff
date: Thu Jul 31 09:05:18 2014 -0500
summary: Bug 1042602 - Symbol behavior changes in ES6 draft rev 26. r=h4writer.
This iteration took 258.790 seconds to run.
Reporter | ||
Updated•10 years ago
|
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
Reporter | ||
Comment 4•10 years ago
|
||
JSBugMon: The testcase found in this bug no longer reproduces (tried revision cd7cbdacf9d8).
Reporter | ||
Updated•10 years ago
|
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:bisectfix]
Reporter | ||
Updated•10 years ago
|
Whiteboard: [jsbugmon:bisectfix] → [jsbugmon:]
Reporter | ||
Comment 5•10 years ago
|
||
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:
The first good revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/9ef873917571
user: Hannes Verschore
date: Mon Aug 18 18:47:47 2014 +0200
summary: Bug 1054753: IonMonkey: Infer functions should not optimize when encountering MIRType_Symbol, r=nbp
This iteration took 312.923 seconds to run.
Updated•10 years ago
|
Blocks: harmony:symbols
Reporter | ||
Comment 6•10 years ago
|
||
Hannes, is the bug in comment 5 a dup of this one?
Flags: needinfo?(hv1989)
Updated•10 years ago
|
Assignee: nobody → jorendorff
Flags: needinfo?(jorendorff)
Updated•10 years ago
|
Status: NEW → RESOLVED
Closed: 10 years ago
Flags: needinfo?(hv1989)
Resolution: --- → DUPLICATE
Updated•10 years ago
|
Assignee: jorendorff → nobody
Updated•9 years ago
|
Group: core-security → core-security-release
Updated•8 years ago
|
Group: core-security-release
You need to log in
before you can comment on or make changes to this bug.
Description
•