TM: "Assertion failure: !ti->stackTypeMap.matches(ti_other->stackTypeMap)" #2

RESOLVED FIXED

Status

()

--
critical
RESOLVED FIXED
10 years ago
10 years ago

People

(Reporter: jruderman, Assigned: dvander)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
x86
Mac OS X
assertion, testcase
Points:
---
Bug Flags:
in-testsuite +
in-litmus -

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment, 1 obsolete attachment)

(Reporter)

Description

10 years ago
I added some stuff to the fuzzer to make it generate type-unstable arrays and iterate through them.  Very quickly, it found this:

for each (let i in [{}, 0, 0, {}, 0, {}, 0]) { }

Assertion failure: !ti->stackTypeMap.matches(ti_other->stackTypeMap), at jstracer.cpp:2727

Testing with rev ab3538891c4, so I have the patch from bug 461945.
Created attachment 345391 [details] [diff] [review]
proposed fix

tell oracle about doubles when we generate an unstable exit.
Assignee: general → danderson
Status: NEW → ASSIGNED
Attachment #345391 - Flags: review?(gal)

Updated

10 years ago
Attachment #345391 - Flags: review?(gal) → review+
Created attachment 345393 [details] [diff] [review]
proposed fix, v2

better fix, deterministic.  speculate all unstable doubles as unpromotable.
Attachment #345391 - Attachment is obsolete: true
Attachment #345393 - Flags: review?(gal)

Updated

10 years ago
Attachment #345393 - Flags: review?(gal) → review+
Pushed fix as changeset: http://hg.mozilla.org/tracemonkey/rev/d8d9e7956897
Status: ASSIGNED → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED

Comment 4

10 years ago
http://hg.mozilla.org/mozilla-central/rev/37b3fdbb0f07
/cvsroot/mozilla/js/tests/js1_7/regress/regress-462071.js,v  <--  regress-462071.js
initial revision: 1.1
Flags: in-testsuite+
Flags: in-litmus-
(Reporter)

Updated

10 years ago
Summary: "Assertion failure: !ti->stackTypeMap.matches(ti_other->stackTypeMap)" #2 → TM: "Assertion failure: !ti->stackTypeMap.matches(ti_other->stackTypeMap)" #2
You need to log in before you can comment on or make changes to this bug.