1708976 - Assertion failure: input->type() == MIRType::Double

Status: RESOLVED DUPLICATE of bug 1593971

(Core :: JavaScript Engine: JIT, defect)

Description

[1422930734]

Attachment: 1

Assertion failure: input->type() == MIRType::Double, at /root/AFL/compile/gecko-dev/js/src/jit/Lowering.cpp:2906
Segmentation fault (core dumped)

Comment 1

[Jan de Mooij [:jandem]]

Thanks for the report.

I can't reproduce this on central so we'll need some additional information:

• Which branch (and code commit) did you use? I checked the central/beta/release/esr78 branches and I don't see that assertion on Lowering.cpp:2906.
• What's the architecture? 32-bit or 64-bit?

Comment 2

[1422930734]

version: JavaScript-C72.0a1
architecture: 64-bit

Comment 3

[Andrew McCreight [:mccr8]]

Firefox 72 is no longer supported. You'll need to find a more recent build of Firefox that is affected.

Comment 4

[Andrew McCreight [:mccr8]]

Can you reproduce this issue on a more recent version? ESR78 is the most recent version that is still supported.

Comment 5

[Daniel Veditz [:dveditz]]

If we get more info we can reopen this bug, but looks like it got fixed some time in the last year+

In fact a bug with this assertion was fixed in Release 72 which would be later than your nightly build

Comment 6

[Andrew McCreight [:mccr8]]

Same assert as bug 1593971, which was fixed in 72.