Closed Bug 786123 Opened 12 years ago Closed 12 years ago

IonMonkey: Assertion failure: [infer failure] Missing type pushed 0: float, at jsinfer.cpp:328

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
Other Branch
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
major

Tracking

()

Status:
RESOLVED DUPLICATE of bug 774644

People

(Reporter: decoder, Unassigned)

References

Details

(Keywords: assertion, testcase, Whiteboard: [ion:p1:fx18] [jsbugmon:]) 

The following testcase asserts on ionmonkey revision 92b9b2840a79 (run with --ion -n -m --ion-eager -a):


function Neptune(){}
function NBodySystem(bodies){
   this.bodies = bodies;
   var e = 0.0;
   var size = this.bodies.length;
   for (var i=0; i<size; i++) {
      var bodyi = this.bodies[i];
      e += 0.5 
      for (var j=i+1; "s.getJSClass()"; j++) {}
   }
}
new NBodySystem(Array(Neptune()));
Whiteboard: [jsbugmon:update] → [jsbugmon:update][ion:p1:fx18]
Whiteboard: [jsbugmon:update][ion:p1:fx18] → [ion:p1:fx18] [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 68df0d67be37).
Whiteboard: [ion:p1:fx18] [jsbugmon:update,ignore] → [ion:p1:fx18] [jsbugmon:bisectfix]
This might actually be a build failure, checking...
Whiteboard: [ion:p1:fx18] [jsbugmon:bisectfix] → [ion:p1:fx18] [jsbugmon:update,ignore]
Retrying...
Whiteboard: [ion:p1:fx18] [jsbugmon:update,ignore] → [ion:p1:fx18] [jsbugmon:bisectfix]
Whiteboard: [ion:p1:fx18] [jsbugmon:bisectfix] → [ion:p1:fx18] [jsbugmon:]
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   105771:547ffa1e37eb
user:        David Anderson
date:        Fri Aug 31 17:41:53 2012 -0700
summary:     Include loop entry types when determining OSR types (bug 774644, r=jandem).
dvander, is this a dup of bug 774644 by comment 4?
Yup, thanks for catching that.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
Group: core-security
You need to log in before you can comment on or make changes to this bug.