1258349 - Assertion failure: size_t(opId.id()) <= 0xffui8, at CacheIR.h:150

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Carsten Book [:Tomcat]]

Attachment: windows debug build stack with todays m-c tip

Assertion failure: size_t(opId.id()) <= 0xffui8, at c:\Users\mozilla\debug-build
s\mozilla-central\js\src\jit/CacheIR.h:150

Steps to reproduce:

--> Load http://www.rentalcars.com/partners/integrations/stand-alone-app/?affiliateCode=jetstar&css=true&template=jetstar&forwardUrl=jetstar.rentalcars.com&preflang=en&prefcurrency=&cor=gb

note: you might click ok on a slow script warning
--> Assertion

tested with todays m-c and windows 7 trunk debug build

Regression of bug Bug 1255352 ?

Comment 1

[Jan de Mooij [:jandem]]

Thanks. This is a bogus assert, will post a patch soon.

Comment 2

[Jan de Mooij [:jandem]]

Attachment: Patch

Bogus assert.

This website must be creating some weird proto chains.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

jsfunfuzz found this too (looking through backlog), but the testcase in comment 2 is very compact and concise, so I won't be filing a new bug.

Comment 4

[Eric Faust [:efaust]]

Comment on attachment 8732838 [details] [diff] [review]
Patch

Review of attachment 8732838 [details] [diff] [review]:
-----------------------------------------------------------------

Oh, indeed. Thanks for the static_assert.

Comment 5

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f76214d65f75

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/f76214d65f75