If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

TypeInference: JM: "Assertion failure: !fe->isType(JSVAL_TYPE_DOUBLE)"

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
7 years ago
5 years ago

People

(Reporter: Jesse Ruderman, Assigned: jandem)

Tracking

(Blocks: 2 bugs, {assertion, regression, testcase})

Trunk
x86
Windows 7
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-jaegermonkey)

Attachments

(1 attachment)

(Reporter)

Description

7 years ago
./js -m
for (p in .3) { }

Assertion failure: !fe->isType(JSVAL_TYPE_DOUBLE), 
at methodjit/FrameState-inl.h:463

The first bad revision is:
changeset:   http://hg.mozilla.org/projects/jaegermonkey/rev/0cd7e38f0b39
user:        Brian Hackett
date:        Fri Oct 29 08:05:55 2010 -0700
summary:     [INFER] Javascript type inference, bug 557407.
(Assignee)

Comment 1

7 years ago
Created attachment 500006 [details] [diff] [review]
Fix

Type inference assigns a double type to the stack slots for the ITER/FOR* opcodes and sets ignoreTypeTag to true. moreIter then calls fixDoubleTypes, which ignores this flag, and assigns a double tag to the iterator object. moreIter then calls tempRegForData and this asserts because it does not expect a double.

This patch adds a check for ignoreTypeTag to fixDoubleTypes. I had to rewrite the loop to be more like the one in restoreAnalysisTypes, so I could access the ignoreTypeTag flag.
Assignee: general → jandemooij
Status: NEW → ASSIGNED
Attachment #500006 - Flags: review?(bhackett1024)
This will I think be unnecessary after the patch for bug 621301 lands tonight (will double check).  That changes things so that types are restored/fixed only for locals and args at basic block boundaries, mirroring the regalloc.  ignoreTypeTag is gone (along with TypeStack), but the horrible iteration hack is still there and can probably bite in other ways --- should find a cleaner fix.
OS: Mac OS X → Windows 7
This testcase works now.

http://hg.mozilla.org/projects/jaegermonkey/rev/fbeecf1d1f4c
Status: ASSIGNED → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-jaegermonkey
(Assignee)

Updated

6 years ago
Attachment #500006 - Flags: review?(bhackett1024)
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug621655.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.