Last Comment Bug 755832 - IonMonkey: Assertion failure: [infer failure] Missing type pushed 0: <0x102503060>
: IonMonkey: Assertion failure: [infer failure] Missing type pushed 0: <0x10250...
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Mac OS X
: -- critical (vote)
: ---
Assigned To: Jan de Mooij [:jandem]
:
Mentors:
Depends on:
Blocks: jsfunfuzz IonFuzz 735400
  Show dependency treegraph
 
Reported: 2012-05-16 11:06 PDT by Jesse Ruderman
Modified: 2013-01-14 07:57 PST (History)
6 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Patch (1.99 KB, patch)
2012-05-18 01:47 PDT, Jan de Mooij [:jandem]
dvander: review+
Details | Diff | Review

Description Jesse Ruderman 2012-05-16 11:06:54 PDT
./js --ion-eager

var x;
function f(o) {
    o.prop = x = 3;
}
f({});
try { f(1); } catch (e) {}

Assertion failure: [infer failure] Missing type pushed 0: <0x102503060>, at js/src/jsinfer.cpp:353
Comment 1 Jan de Mooij [:jandem] 2012-05-18 01:47:29 PDT
Created attachment 625036 [details] [diff] [review]
Patch

Small bug: the resumepoint after a setgname did not include the value (on top of the stack). The patch moves the resumeAfter call after pushing the value so that the value is still on the stack for the SETPROP in the testcase.
Comment 2 Jan de Mooij [:jandem] 2012-05-18 02:05:32 PDT
To be more precise, the resumepoint was created before popping the global object and pushing the value, so it includes the global object instead of the value (hence the inference failure, <0x102503060> is a global object).
Comment 3 David Anderson [:dvander] 2012-05-18 10:23:12 PDT
Comment on attachment 625036 [details] [diff] [review]
Patch

Review of attachment 625036 [details] [diff] [review]:
-----------------------------------------------------------------

Yikes. Good find. I think this was the first function to use resume points.
Comment 4 Jan de Mooij [:jandem] 2012-05-18 12:14:25 PDT
https://hg.mozilla.org/projects/ionmonkey/rev/47b283284868
Comment 5 Christian Holler (:decoder) 2013-01-14 07:57:29 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug755832.js.

Note You need to log in before you can comment on or make changes to this bug.