743128 - IonMonkey: Assertion failure: enumerators == cx->enumerators, at jsinterp.cpp:457 or Crash [@ js::HeapPtr<js::BaseShape, unsigned long>::operator]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on ionmonkey revision a9a18824b4c1 (run with --ion -n -m):


try {
evaluate("\
var statsuffix =  ', testing it now -';\
var index = [-1073741825, \
	-1073741824, -1073741823, -5000, -507, \
	-3, -2, -1, -0, 0, 1, 2, 3, 1073741823, \
	1073741824, 1073741825];\
test();\
function test() {\
  for (var j in index) {testProperty(index[j]);}\
}\
function testProperty(i) {\
function positive(n) { return 1 / n > 0; }\
         (positive(i) ? ((a).m.abstract ) : '-' + -i) + \
         statsuffix;\
}\
");
} catch(exc3) {}
evaluate("test();");

Comment 1

[Kannan Vijayan [:djvj]]

Not reproduceable on revision 6e58d603a684, OSX, Intel 64-bit.  Can someone confirm whether this still exists or is no longer valid?

Comment 2

[Christian Holler (:decoder)]

For some reason I can't even reproduce this on the original revision. I'm marking this wfm, it'll pop up again eventually during fuzzing if it's still there.