If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

IonMonkey: Assertion failure: enumerators == cx->enumerators, at jsinterp.cpp:457 or Crash [@ js::HeapPtr<js::BaseShape, unsigned long>::operator]

RESOLVED WORKSFORME

Status

()

Core
JavaScript Engine
--
major
RESOLVED WORKSFORME
6 years ago
5 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Other Branch
x86
Linux
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update,reconfirm], crash signature)

(Reporter)

Description

6 years ago
The following testcase asserts on ionmonkey revision a9a18824b4c1 (run with --ion -n -m):


try {
evaluate("\
var statsuffix =  ', testing it now -';\
var index = [-1073741825, \
	-1073741824, -1073741823, -5000, -507, \
	-3, -2, -1, -0, 0, 1, 2, 3, 1073741823, \
	1073741824, 1073741825];\
test();\
function test() {\
  for (var j in index) {testProperty(index[j]);}\
}\
function testProperty(i) {\
function positive(n) { return 1 / n > 0; }\
         (positive(i) ? ((a).m.abstract ) : '-' + -i) + \
         statsuffix;\
}\
");
} catch(exc3) {}
evaluate("test();");
(Reporter)

Updated

6 years ago
Crash Signature: [@ js::HeapPtr<js::BaseShape, unsigned long>::operator]
Summary: IonMonkey: Assertion failure: enumerators == cx->enumerators, at jsinterp.cpp:457 → IonMonkey: Assertion failure: enumerators == cx->enumerators, at jsinterp.cpp:457 or Crash [@ js::HeapPtr<js::BaseShape, unsigned long>::operator]
Not reproduceable on revision 6e58d603a684, OSX, Intel 64-bit.  Can someone confirm whether this still exists or is no longer valid?
(Reporter)

Updated

5 years ago
Whiteboard: [jsbugmon:update] → [jsbugmon:update,reconfirm]
(Reporter)

Comment 2

5 years ago
For some reason I can't even reproduce this on the original revision. I'm marking this wfm, it'll pop up again eventually during fuzzing if it's still there.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.