As a security precaution, we have turned on the setting "Require API key authentication for API requests" for everyone. If this has broken something, please contact
Last Comment Bug 755832 - IonMonkey: Assertion failure: [infer failure] Missing type pushed 0: <0x102503060>
: IonMonkey: Assertion failure: [infer failure] Missing type pushed 0: <0x10250...
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Mac OS X
: -- critical (vote)
: ---
Assigned To: Jan de Mooij [:jandem]
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: jsfunfuzz IonFuzz 735400
  Show dependency treegraph
Reported: 2012-05-16 11:06 PDT by Jesse Ruderman
Modified: 2013-01-14 07:57 PST (History)
6 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Patch (1.99 KB, patch)
2012-05-18 01:47 PDT, Jan de Mooij [:jandem]
dvander: review+
Details | Diff | Splinter Review

Description User image Jesse Ruderman 2012-05-16 11:06:54 PDT
./js --ion-eager

var x;
function f(o) {
    o.prop = x = 3;
try { f(1); } catch (e) {}

Assertion failure: [infer failure] Missing type pushed 0: <0x102503060>, at js/src/jsinfer.cpp:353
Comment 1 User image Jan de Mooij [:jandem] 2012-05-18 01:47:29 PDT
Created attachment 625036 [details] [diff] [review]

Small bug: the resumepoint after a setgname did not include the value (on top of the stack). The patch moves the resumeAfter call after pushing the value so that the value is still on the stack for the SETPROP in the testcase.
Comment 2 User image Jan de Mooij [:jandem] 2012-05-18 02:05:32 PDT
To be more precise, the resumepoint was created before popping the global object and pushing the value, so it includes the global object instead of the value (hence the inference failure, <0x102503060> is a global object).
Comment 3 User image David Anderson [:dvander] 2012-05-18 10:23:12 PDT
Comment on attachment 625036 [details] [diff] [review]

Review of attachment 625036 [details] [diff] [review]:

Yikes. Good find. I think this was the first function to use resume points.
Comment 4 User image Jan de Mooij [:jandem] 2012-05-18 12:14:25 PDT
Comment 5 User image Christian Holler (:decoder) 2013-01-14 07:57:29 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug755832.js.

Note You need to log in before you can comment on or make changes to this bug.