Closed Bug 1055033 Opened 8 years ago Closed 8 years ago

Assertion failure: false (MOZ_ASSERT_UNREACHABLE: unexpected type), at jit/Lowering.cpp:1776 with Symbol

Categories

(Core :: JavaScript Engine: JIT, defect)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 1054512
Tracking Status
firefox34 --- affected

People

(Reporter: decoder, Unassigned)

References

Details

(Keywords: assertion, testcase, Whiteboard: [jsbugmon:])

Attachments

(1 file)

The following testcase asserts on mozilla-central revision 0aaa2d3d15cc (run with --no-threads --fuzzing-safe --ion-eager):


var callStack = new Array();
function TestCase(e, a)
  this.passed = getTestCaseResult(e, a);
function reportCompare (e, a) {
  var testcase = new TestCase(e, a);
}
function exitFunc (funcName) {
  var lastFunc = callStack.pop();
  reportCompare(funcName, lastFunc);
}
function getTestCaseResult(e, a) {
  if (typeof e != typeof a)
    return a == e;
  if (a != a) {}
}
exitFunc('test');
var SSN_pattern = new RegExp("\\d{3}-\\d{2}-\\d{4}");
new TestCase (NaN,SSN_pattern - 1);
var replacer = function (key, val) {
  reportCompare(val, Symbol.iterator);
};
JSON.stringify(Symbol.iterator, replacer)
Could be the same as bug 1055015, but then again we had a lot of very similar Symbol bugs that were distinct issues. Needinfo from Jason.
Flags: needinfo?(jorendorff)
Whiteboard: [jsbugmon:update,bisect]
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update,bisect,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision a38daccaa557).
Whiteboard: [jsbugmon:update,bisect,ignore] → [jsbugmon:bisectfix]
Whiteboard: [jsbugmon:bisectfix] → [jsbugmon:]
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/43494708df76
user:        Hannes Verschore
date:        Mon Aug 18 21:37:10 2014 +0200
summary:     Bug 1054512: IonMonkey: Run the type policy of added instructions during type analysis, r=jandem

This iteration took 0.868 seconds to run.
Hannes, did comment 4 fix this bug?
Flags: needinfo?(hv1989)
Flags: needinfo?(jorendorff)
Status: NEW → RESOLVED
Closed: 8 years ago
Flags: needinfo?(hv1989)
Resolution: --- → DUPLICATE
Duplicate of bug: 1054512
Group: core-security → core-security-release
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.