1146410 - Assertion failure: Integer input should be equal or higher than Lowerbound., at js/src/jit/MacroAssembler.cpp:1694

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 4d2d97b3ba34 (build with --enable-optimize --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug, run with --ion-offthread-compile=off --ion-eager --ion-check-range-analysis):

function foo() {
  var ws = new WeakSet();
  ws.add({});
  for (var i = 0; i < 10; i++)
    ws.add(WeakSet + "");
}
foo();
delete Math;



Backtrace:

Program received signal SIGTRAP, Trace/breakpoint trap.
0x00007ffff7e598f7 in ?? ()
[...]
#16 0x0000000000000000 in ?? ()
rax	0xf4f77028	4109856808
rbx	0xfffc7ffff5000120	-985162603036384
rcx	0x7ffff4f577c0	140737303115712
rdx	0xfff9800000000000	-1829587348619264
rsi	0x1	1
rdi	0x7fffffffbc98	140737488338072
rbp	0xfff8800000000000	18444633011384221696
rsp	0x7fffffffbc70	140737488338032
r8	0xfffbffffffffffff	-1125899906842625
r9	0x28	40
r10	0x0	0
r11	0x7ffff6c27960	140737333328224
r12	0x8	8
r13	0x7fffffffca70	140737488341616
r14	0x203	515
r15	0x1a214b0	27399344
rip	0x7ffff7e598f7	140737352407287
=> 0x7ffff7e598f7:	cmp    $0x1,%eax
   0x7ffff7e598fa:	jle    0x7ffff7e59a1c


Marking s-s because this is a range analysis issue.

Comment 1

[Andrew McCreight [:mccr8]]

This sounds sketchy, so marking sec-high. Adjust as needed.

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
=== Treeherder Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20150227161626" and the hash "928ec762c672".
The "bad" changeset has the timestamp "20150227163831" and the hash "490afdad9ba1".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=928ec762c672&tochange=490afdad9ba1

Comment 3

[Christian Holler (:decoder)]

Possibly regressed by bug 994016, needinfo from h4writer based on comment 2.

Comment 4

[Hannes Verschore [:h4writer]]

Attachment: Print typeset to any fp

I often make this change to print something to somewhere else than stderr. Can we land this. (This is not a fix!)

Comment 5

[Hannes Verschore [:h4writer]]

Attachment: Patch

Typo: ins->type() was used instead of ins->getOperand(0)->type()

Comment 6

[Jan de Mooij [:jandem]]

Comment on attachment 8583698 [details] [diff] [review]
Patch

Review of attachment 8583698 [details] [diff] [review]:
-----------------------------------------------------------------

Which branches does this affect? If it's only 39, can you add the test?

Comment 7

[Hannes Verschore [:h4writer]]

Yes, FF39 only.
https://hg.mozilla.org/integration/mozilla-inbound/rev/c58c75afbd91
https://hg.mozilla.org/integration/mozilla-inbound/rev/4c099b1b4e58

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/c58c75afbd91
https://hg.mozilla.org/mozilla-central/rev/4c099b1b4e58

Comment 9

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.