1055033 - Assertion failure: false (MOZ_ASSERT_UNREACHABLE: unexpected type), at jit/Lowering.cpp:1776 with Symbol

Status: RESOLVED DUPLICATE of bug 1054512

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 0aaa2d3d15cc (run with --no-threads --fuzzing-safe --ion-eager):


var callStack = new Array();
function TestCase(e, a)
  this.passed = getTestCaseResult(e, a);
function reportCompare (e, a) {
  var testcase = new TestCase(e, a);
}
function exitFunc (funcName) {
  var lastFunc = callStack.pop();
  reportCompare(funcName, lastFunc);
}
function getTestCaseResult(e, a) {
  if (typeof e != typeof a)
    return a == e;
  if (a != a) {}
}
exitFunc('test');
var SSN_pattern = new RegExp("\\d{3}-\\d{2}-\\d{4}");
new TestCase (NaN,SSN_pattern - 1);
var replacer = function (key, val) {
  reportCompare(val, Symbol.iterator);
};
JSON.stringify(Symbol.iterator, replacer)

Comment 1

[Christian Holler (:decoder)]

Could be the same as bug 1055015, but then again we had a lot of very similar Symbol bugs that were distinct issues. Needinfo from Jason.

Comment 2

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 3

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision a38daccaa557).

Comment 4

[Christian Holler (:decoder)]

JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/43494708df76
user:        Hannes Verschore
date:        Mon Aug 18 21:37:10 2014 +0200
summary:     Bug 1054512: IonMonkey: Run the type policy of added instructions during type analysis, r=jandem

This iteration took 0.868 seconds to run.

Comment 5

[Christian Holler (:decoder)]

Hannes, did comment 4 fix this bug?