1079850 - Hit MOZ_CRASH(Types should be in accordance.) at jit/TypePolicy.cpp:872 or Crash [@ js::jit::FilterTypeSetPolicy::adjustInputs]

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision e4cfacb76830 (run with --no-threads --fuzzing-safe --ion-eager):


function foo() {
  for(__key in null)
    var key=startTest(VERSION) ? this : this;
  if (key !== undefined) {}
} foo();

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

It looks like the opt-crash also hits a MOZ_CRASH but doesn't output a message (just crashes at NULL). Marked this s-s until triaged because the debug message indicates some form of type mismatch.

Comment 3

[Hannes Verschore [:h4writer]]

A crash place I added a few days ago.

Comment 4

[Hannes Verschore [:h4writer]]

Attachment: Patch

This can happen if we haven't seen the type of that branch yet. So we will have to add this code to force a bail here.

Comment 5

[Hannes Verschore [:h4writer]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/790c862b4c2a

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/790c862b4c2a

Comment 7

[Hannes Verschore [:h4writer]]

Not ss