Closed Bug 1077349 Opened 10 years ago Closed 10 years ago

Assertion failure: isInitialized(), at jit/IonFrames.cpp:1494

Categories

(Core :: JavaScript Engine: JIT, defect)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 1075488
Tracking Status
firefox35 --- affected

People

(Reporter: decoder, Assigned: nbp)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])

Attachments

(1 file)

The following testcase asserts on mozilla-central revision b85c260821ab (run with --no-threads --fuzzing-safe --baseline-eager --ion-eager):


eval("(function () {\
function boo() {\
  return foo.arguments[0];\
}\
function foo(a,b,c) {\
  if (a == 0) {\
    a ^= (1);\
    return boo();\
  }\
}\
function inlined() {\
  return foo.apply({}, arguments);\
}\
assertEq(inlined(1,2,3), undefined);\
assertEq(inlined(0,(1),3), 0);\
})();");
Marked s-s because the assertion indicates that something might be used although it's not initialized properly. The test does not crash though.
Whiteboard: [jsbugmon:update,bisect]
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/2178d3ceaee1
user:        Nicolas B. Pierron
date:        Tue Sep 23 19:42:35 2014 +0200
summary:     Bug 1062869 part 6 - Handle early execution of recover instructions. r=h4writer

This iteration took 311.847 seconds to run.
Blocks: 1062869
Flags: needinfo?(nicolas.b.pierron)
Keywords: regression
This looks like a duplicate of Bug 1075488, I will verify tomorrow.
This is indeed a duplicate of Bug 1075488 that I found while fixing other issues related to scalar replacement.  I will still land the test case as it is interesting to have in the test suite.
Status: NEW → RESOLVED
Closed: 10 years ago
Flags: needinfo?(nicolas.b.pierron)
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.