Last Comment Bug 764792 - IonMonkey: Crash [@ js::ion::TypeInferenceOracle::binaryOp] or "Assertion failure: false (Bad SSA value),"
: IonMonkey: Crash [@ js::ion::TypeInferenceOracle::binaryOp] or "Assertion fai...
Status: RESOLVED FIXED
[jsbugmon:update]
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: All All
: -- critical (vote)
: ---
Assigned To: David Anderson [:dvander]
:
Mentors:
Depends on:
Blocks: jsfunfuzz langfuzz IonFuzz 761685
  Show dependency treegraph
 
Reported: 2012-06-14 06:08 PDT by Christian Holler (:decoder)
Modified: 2013-01-14 07:46 PST (History)
9 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
fix (3.24 KB, patch)
2012-07-05 16:48 PDT, David Anderson [:dvander]
bhackett1024: review+
Details | Diff | Review

Description Christian Holler (:decoder) 2012-06-14 06:08:32 PDT
The following testcase asserts on ionmonkey revision 7ab88528503e (run with --ion -n -m --ion-eager):


test();
function test() {
  for (var i=0; i<2; ++i) {};
  try {}  catch ([ q ]) {
      function g() {}
  }     
}
Comment 1 Gary Kwong [:gkw] [:nth10sd] 2012-07-03 00:25:45 PDT
The assertion has changed to Assertion failure: false (Bad SSA value), and there is an opt crash at js::ion::TypeInferenceOracle::binaryOp when the testcase in comment 0 is run with --ion-eager on 10.6, tested on IonMonkey changeset 6688ede89a36.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   97982:b2223a34e849
user:        David Anderson
date:        Thu Jun 14 01:21:31 2012 -0700
summary:     Add support for CallObjects and heavyweight functions (bug 761685, r=jandem,luke).
Comment 2 David Anderson [:dvander] 2012-07-05 16:48:27 PDT
Created attachment 639516 [details] [diff] [review]
fix

Bug is that we're misusing the TI API a bit. If the local isn't tracked we can't asked for pushedTypes.
Comment 3 Sean Stangl [:sstangl] 2012-07-06 14:10:58 PDT
http://hg.mozilla.org/projects/ionmonkey/rev/13df3c40ef7a
Comment 4 Christian Holler (:decoder) 2013-01-14 07:46:51 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug764792.js.

Note You need to log in before you can comment on or make changes to this bug.