Last Comment Bug 764792 - IonMonkey: Crash [@ js::ion::TypeInferenceOracle::binaryOp] or "Assertion failure: false (Bad SSA value),"
: IonMonkey: Crash [@ js::ion::TypeInferenceOracle::binaryOp] or "Assertion fai...
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: All All
-- critical (vote)
: ---
Assigned To: David Anderson [:dvander]
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: jsfunfuzz langfuzz IonFuzz 761685
  Show dependency treegraph
Reported: 2012-06-14 06:08 PDT by Christian Holler (:decoder)
Modified: 2013-01-14 07:46 PST (History)
9 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

fix (3.24 KB, patch)
2012-07-05 16:48 PDT, David Anderson [:dvander]
bhackett1024: review+
Details | Diff | Splinter Review

Description User image Christian Holler (:decoder) 2012-06-14 06:08:32 PDT
The following testcase asserts on ionmonkey revision 7ab88528503e (run with --ion -n -m --ion-eager):

function test() {
  for (var i=0; i<2; ++i) {};
  try {}  catch ([ q ]) {
      function g() {}
Comment 1 User image Gary Kwong [:gkw] [:nth10sd] 2012-07-03 00:25:45 PDT
The assertion has changed to Assertion failure: false (Bad SSA value), and there is an opt crash at js::ion::TypeInferenceOracle::binaryOp when the testcase in comment 0 is run with --ion-eager on 10.6, tested on IonMonkey changeset 6688ede89a36.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   97982:b2223a34e849
user:        David Anderson
date:        Thu Jun 14 01:21:31 2012 -0700
summary:     Add support for CallObjects and heavyweight functions (bug 761685, r=jandem,luke).
Comment 2 User image David Anderson [:dvander] 2012-07-05 16:48:27 PDT
Created attachment 639516 [details] [diff] [review]

Bug is that we're misusing the TI API a bit. If the local isn't tracked we can't asked for pushedTypes.
Comment 3 User image Sean Stangl [:sstangl] 2012-07-06 14:10:58 PDT
Comment 4 User image Christian Holler (:decoder) 2013-01-14 07:46:51 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug764792.js.

Note You need to log in before you can comment on or make changes to this bug.