Closed
Bug 663690
Opened 10 years ago
Closed 10 years ago
TI: "Assertion failure: [infer failure] Missing type pushed 0: string,"
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Unassigned)
References
(Blocks 1 open bug)
Details
(Keywords: assertion, testcase)
function g(c) { b = b = h(c); } function j(s) { return Function(s) } function h(c) { return j(c)() } g() var a Boolean.__proto__[a] = [] g("return gc()") asserts js debug shell on JM changeset 38f2fbc8490d with -m, -a and -n at Assertion failure: [infer failure] Missing type pushed 0: string, This was found using a combination of jsfunfuzz and jandem's method fuzzer.
![]() |
Reporter | |
Comment 1•10 years ago
|
||
Because of the uniquely positioned gc, the testcase took a hideously long time to reduce. :-/
![]() |
Reporter | |
Comment 2•10 years ago
|
||
autoBisect shows this is probably related to the following changeset: The first good revision is: changeset: 63404:38bc7af66c0b user: Brian Hackett date: Sun Mar 20 09:48:13 2011 -0700 summary: [INFER] Don't try to fully update the pushed types on uncacheable NAME ops, bug 643113.
![]() |
Reporter | |
Comment 3•10 years ago
|
||
(In reply to comment #2) > autoBisect shows this is probably related to the following changeset: > > The first good revision is: > changeset: 63404:38bc7af66c0b > user: Brian Hackett > date: Sun Mar 20 09:48:13 2011 -0700 > summary: [INFER] Don't try to fully update the pushed types on > uncacheable NAME ops, bug 643113. Not sure if this is entirely correct or not..
Comment 4•10 years ago
|
||
When returning into the interpoline after finishing a scripted call, the interpoline needed to monitor the result of the call. (Monitoring in the interpoline isn't needed in other places, because there we are returning from a stub call which is responsible for calling monitor() itself). This is a regression from rev a2dbb9efcf9e, which introduced type barriers at call sites. http://hg.mozilla.org/projects/jaegermonkey/rev/f59a6cabfbd4
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Comment 6•8 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/recompile/bug663690.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•