663690 - TI: "Assertion failure: [infer failure] Missing type pushed 0: string,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function g(c) {
  b = b = h(c);
}
function j(s) {
  return Function(s)
}
function h(c) {
  return j(c)()
}
g()
var a
Boolean.__proto__[a] = []
g("return gc()")

asserts js debug shell on JM changeset 38f2fbc8490d with -m, -a and -n at Assertion failure: [infer failure] Missing type pushed 0: string,

This was found using a combination of jsfunfuzz and jandem's method fuzzer.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Because of the uniquely positioned gc, the testcase took a hideously long time to reduce. :-/

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   63404:38bc7af66c0b
user:        Brian Hackett
date:        Sun Mar 20 09:48:13 2011 -0700
summary:     [INFER] Don't try to fully update the pushed types on uncacheable NAME ops, bug 643113.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #2)
> autoBisect shows this is probably related to the following changeset:
> 
> The first good revision is:
> changeset:   63404:38bc7af66c0b
> user:        Brian Hackett
> date:        Sun Mar 20 09:48:13 2011 -0700
> summary:     [INFER] Don't try to fully update the pushed types on
> uncacheable NAME ops, bug 643113.

Not sure if this is entirely correct or not..

Comment 4

[Brian Hackett [Laid off!]]

When returning into the interpoline after finishing a scripted call, the interpoline needed to monitor the result of the call.  (Monitoring in the interpoline isn't needed in other places, because there we are returning from a stub call which is responsible for calling monitor() itself).  This is a regression from rev a2dbb9efcf9e, which introduced type barriers at call sites.

http://hg.mozilla.org/projects/jaegermonkey/rev/f59a6cabfbd4

Comment 6

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/recompile/bug663690.js.