Closed Bug 600135 Opened 14 years ago Closed 14 years ago

TM: "Assertion failure: LIR type error (start of writer pipeline): arg 1 of 'eqd' is 'immi' which has type int32 (expected float64): 0 "

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 600128
Tracking Status
blocking2.0 --- betaN+
status1.9.2 --- unaffected
status1.9.1 --- unaffected

People

(Reporter: gkw, Assigned: Waldo)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: [sg:dupe 600128])

if (__defineSetter__("x", Object.seal)) {}
x = this
for (var z = 0; z < 10; z++) {
    if (o = 0) {}
}

asserts js debug shell on TM changeset 54700fad8cf9 with -j at Assertion failure: LIR type error (start of writer pipeline): arg 1 of 'eqd' is 'immi' which has type int32 (expected float64): 0 when passed in as a CLI argument.

s-s because LIR type errors seem bad..
blocking2.0: --- → ?
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   54278:441f83a81fb8
user:        Jim Blandy
date:        Tue Sep 21 11:35:30 2010 -0700
summary:     Bug 492845: Implement Object.isSealed, Object.seal. a=jwalden, r=brendan
Blocks: 492845
Using the technique in bug 579740 comment #3:

$ TMFLAGS=recorder ./js-dbg-32-tm-linux -j lirAssert.js
    start
    ebx = parami 0 ebx
    esi = parami 1 esi
    edi = parami 2 edi
    state = parami 0 ecx

    About to try emitting guard code for SideExit=0x99b65cc exitType=TIMEOUT
    label1:
    sp = ldi.o state[8]
    rp = ldi.o state[24]
    cx = ldi.o state[0]
    eos = ldi.o state[12]
    eor = ldi.o state[28]
    strict = immi 0
    (void *) &JS_THREAD_DATA(cx)->interruptFlags = immi 0x994881c
    ldi1 = ldi.o/v (void *) &JS_THREAD_DATA(cx)->interruptFlags/*0x994881c*/[0]
    eqi1 = eqi ldi1, strict/*0*/
    xf1: xf eqi1 -> pc=0x999f8a7 imacpc=(nil) sp+0 rp+0 (GuardID=001)

00035:   3  trace
00036:   4  bindgname "o"
00039:   4  zero
00040:   4  setgname "o"
00043:   4  ifeq 46 (3)
    About to try emitting guard code for SideExit=0x99b660c exitType=BRANCH
    globalObj = immi 0xf6d02038
    sti.s sp[0] = globalObj/*0xf6d02038*/
    immd1 = immd 0
    sti.s sp[8] = strict/*0*/
    eqd1 = eqd globalObj/*0xf6d02038*/, immd1/*0*/
    eqi2 = eqi eqd1, strict/*0*/
    eqd2 = eqd globalObj/*0xf6d02038*/, globalObj/*0xf6d02038*/
    andi1 = andi eqd2, eqi2
    eqi3 = eqi andi1, strict/*0*/
    xf2: xf eqi3 -> pc=0x999f8af imacpc=(nil) sp+8 rp+0 (GuardID=002)

00046:   3  globalinc "z"
    About to try emitting guard_xov code for SideExit=0x99b6654 exitType=OVERFLOW
    ldi2 = ldi.o eos[1528]
    $global0 = i2d ldi2
    immd2 = immd 1
    immi1 = immi 1
    addxovi1 = addxovi ldi2, immi1/*1*/ -> pc=0x999f8b2 imacpc=(nil) sp+0 rp+0 (GuardID=003)

00050:   3  getglobal "z"
00053:   3  int8 10
00055:   3  lt
    About to try emitting guard code for SideExit=0x99b669c exitType=LOOP
    i2d1 = i2d addxovi1
    sti.s sp[0] = ldi2
    sti.o eos[1528] = addxovi1
    sti.s sp[0] = addxovi1
    immd3 = immd 10
    immi2 = immi 10
    sti.s sp[8] = immi2/*10*/
    lti1 = lti addxovi1, immi2/*10*/
    xf3: xf lti1 -> pc=0x999f8bb imacpc=(nil) sp+16 rp+0 (GuardID=004)

    j -> label1
    livei state
    x1: x  -> pc=0x999f8a7 imacpc=(nil) sp+0 rp+0 (GuardID=005)

Assertion failure: lhs->isD() && rhs->isD()
blocking2.0: ? → betaN+
Whiteboard: [sg:critical]
This looks like a duplicate of bug 600128, will circle back around when that bug's fixed.
Assignee: general → jwalden+bmo
OS: Linux → All
Hardware: x86 → All
Can you check again, Waldo?
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → DUPLICATE
Whiteboard: [sg:critical] → [sg:dupe 600128]
Group: core-security
A testcase for this bug was already added in the original bug (bug 600128).
Flags: in-testsuite-
You need to log in before you can comment on or make changes to this bug.