If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

IonMonkey: Assertion failure: [infer failure] Missing type pushed 0: float, at jsinfer.cpp:311

VERIFIED FIXED in Firefox 18

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Assigned: sstangl)

Tracking

(Blocks: 2 bugs, {assertion, regression, testcase})

Trunk
mozilla19
x86_64
Linux
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox15 unaffected, firefox16 unaffected, firefox17 unaffected, firefox18- fixed, firefox19- fixed, firefox-esr10 unaffected, firefox-esr17 unaffected)

Details

(Whiteboard: [jsbugmon:update,reconfirm,ignore][ion:p1][adv-main18-])

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
The following testcase asserts on mozilla-central revision ecd4c4304219 (run with --ion-eager):


function RandBool() { var x = Math.random() >= 0.5; return x; }
var CHARS = "aaa";
function RandStr() {
  var c = Math.floor(Math.random() * CHARS.length);
}
function RandVal() { 
  return RandBool() ? RandStr() : RandStr(); 
}
function GenerateSpecPermutes(matchVals, resultArray) {
    var maxPermuteBody = (1 << matchVals.length) - 1;
    for(var bod_pm = 0; bod_pm <= maxPermuteBody; bod_pm++)
      for(var k = 0; k < matchVals.length; k++)
        var body = ((bod_pm & (1 << k)) > 0) ? null : RandVal();
}
GenerateSpecPermutes(["foo", "bar", "zing"]);
(Reporter)

Comment 1

5 years ago
S-s due to infer failure, CCing IonMonkey team.
Whiteboard: [jsbugmon:update,bisect]

Updated

5 years ago
Blocks: 724444
(Reporter)

Updated

5 years ago
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update,reconfirm,bisect]
(Reporter)

Updated

5 years ago
Whiteboard: [jsbugmon:update,reconfirm,bisect] → [jsbugmon:update,reconfirm,ignore]
(Reporter)

Comment 2

5 years ago
JSBugMon: This bug has been automatically confirmed to be still valid (reproduced on revision aa5e3b445810).
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   109435:64bf5f240ccb
user:        Sean Stangl
date:        Fri Oct 05 12:05:21 2012 -0700
summary:     Bug 797551 - Use callWithABI() for Math.random(). r=dvander

This iteration took 100.125 seconds to run.
(Assignee)

Updated

5 years ago
Assignee: general → sstangl
Whiteboard: [jsbugmon:update,reconfirm,ignore] → [jsbugmon:update,reconfirm,ignore][ion:p1]
(Assignee)

Comment 3

5 years ago
Created attachment 669732 [details] [diff] [review]
Confer with TI about the return type of Math.random().

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 797551
User impact if declined: Unlikely crashes
Testing completed (on m-c, etc.): on m-i
Risk to taking this patch (and alternatives if risky): none
String or UUID changes made by this patch: none
Attachment #669732 - Flags: review?(dvander)
Attachment #669732 - Flags: approval-mozilla-aurora?
Setting flags based on regression range.
status-firefox-esr10: --- → unaffected
status-firefox15: --- → unaffected
status-firefox16: --- → unaffected
status-firefox17: --- → unaffected
status-firefox18: --- → affected
status-firefox19: --- → affected
status-firefox-esr17: --- → unaffected
tracking-firefox18: --- → ?
tracking-firefox19: --- → ?
Keywords: regression
Comment on attachment 669732 [details] [diff] [review]
Confer with TI about the return type of Math.random().

Review of attachment 669732 [details] [diff] [review]:
-----------------------------------------------------------------

r=me with the test case included, if possible
Attachment #669732 - Flags: review?(dvander) → review+

Updated

5 years ago
tracking-firefox18: ? → -
tracking-firefox19: ? → -

Comment 6

5 years ago
Comment on attachment 669732 [details] [diff] [review]
Confer with TI about the return type of Math.random().

Please refrain from nominating for uplift before landing on m-c.
Attachment #669732 - Flags: approval-mozilla-aurora?
(Assignee)

Comment 7

5 years ago
http://hg.mozilla.org/integration/mozilla-inbound/rev/315e66e6b2ae

Comment 8

5 years ago
https://hg.mozilla.org/mozilla-central/rev/315e66e6b2ae
Status: NEW → RESOLVED
Last Resolved: 5 years ago
status-firefox19: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla19
(Reporter)

Updated

5 years ago
Status: RESOLVED → VERIFIED
(Reporter)

Comment 9

5 years ago
JSBugMon: This bug has been automatically verified fixed.
(Assignee)

Comment 10

5 years ago
Comment on attachment 669732 [details] [diff] [review]
Confer with TI about the return type of Math.random().

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 797551
User impact if declined: Unlikely crashes
Testing completed (on m-c, etc.): on m-i
Risk to taking this patch (and alternatives if risky): none
String or UUID changes made by this patch: none
Attachment #669732 - Flags: approval-mozilla-aurora?
Comment on attachment 669732 [details] [diff] [review]
Confer with TI about the return type of Math.random().

Approving the patch on aurora as the fix will avoid unlikely crashes and is low risk .
Attachment #669732 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
https://hg.mozilla.org/releases/mozilla-aurora/rev/dbcf23129506
status-firefox18: affected → fixed
Flags: in-testsuite+
Whiteboard: [jsbugmon:update,reconfirm,ignore][ion:p1] → [jsbugmon:update,reconfirm,ignore][ion:p1][adv-main18-]
Group: core-security
You need to log in before you can comment on or make changes to this bug.