732857 - IonMonkey: Assertion failure: isArgument(), at ion/LIR-inl.h:73

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on ionmonkey revision 1fd6c40d3852 (run with --ion -n):


function TestCase(n, d, e, a) {};
  this.__proto__ = []; 
var msPerDay =   86400000;
var TIME_1900  = -2208988800000;
function TimeFromYear( y ) {
  return ( msPerDay * DayFromYear(y) );
}
function DayFromYear( y ) {
  return ( 365*(y-1970) +
           Math.floor((y-1601)/400) );
}
function YearFromTime( t ) {
  var sign = ( t < 0 ) ? -1 : 1;
  var year = ( sign < 0 ) ? 1969 : 1970;
  return ( year );
}
var SECTION = "15.9.5.10";
addTestCase( TIME_1900 );
function addTestCase( t ) {
  var start = TimeFromYear(YearFromTime(t));
  var stop  = TimeFromYear(YearFromTime(t) + 1);
  for (var d = start; d < stop; d += msPerDay) {
    new TestCase( SECTION,
                  (new Date( SECTION   ? "Failed" : prototype +=  "'abc'.search(new RegExp('^'))") ).getDate() );
  }
}

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

The bug here is that an LPassArg leaked into a snapshot. Haven't looked further yet. Somehow we didn't unwrap.

Comment 2

[Christian Holler (:decoder)]

Doesn't seem to reproduce for me on a more recent build. Gary, can you bisect
if/when this was fixed?

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Probably fixed by bug 723333.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   91137:5108b08c2d54
user:        Sean Stangl
date:        Wed Mar 21 17:25:43 2012 -0700
summary:     Bug 723333 - Handle JSOP_NEW without callVM(). r=dvander

Comment 4

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/2e891e0db397