462071 - TM: "Assertion failure: !ti->stackTypeMap.matches(ti_other->stackTypeMap)" #2

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

I added some stuff to the fuzzer to make it generate type-unstable arrays and iterate through them.  Very quickly, it found this:

for each (let i in [{}, 0, 0, {}, 0, {}, 0]) { }

Assertion failure: !ti->stackTypeMap.matches(ti_other->stackTypeMap), at jstracer.cpp:2727

Testing with rev ab3538891c4, so I have the patch from bug 461945.

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: proposed fix

tell oracle about doubles when we generate an unstable exit.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: proposed fix, v2

better fix, deterministic.  speculate all unstable doubles as unpromotable.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Pushed fix as changeset: http://hg.mozilla.org/tracemonkey/rev/d8d9e7956897

Comment 4

[Bob Clary [:bc] (inactive)]

http://hg.mozilla.org/mozilla-central/rev/37b3fdbb0f07
/cvsroot/mozilla/js/tests/js1_7/regress/regress-462071.js,v  <--  regress-462071.js
initial revision: 1.1