Closed Bug 798946 Opened 7 years ago Closed 7 years ago

IonMonkey: Assertion failure: [infer failure] Missing type pushed 0: float, at jsinfer.cpp:311

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla19
Tracking Status
firefox15 --- unaffected
firefox16 --- unaffected
firefox17 --- unaffected
firefox18 - fixed
firefox19 - fixed
firefox-esr10 --- unaffected
firefox-esr17 --- unaffected

People

(Reporter: decoder, Assigned: sstangl)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update,reconfirm,ignore][ion:p1][adv-main18-])

Attachments

(1 file)

The following testcase asserts on mozilla-central revision ecd4c4304219 (run with --ion-eager):


function RandBool() { var x = Math.random() >= 0.5; return x; }
var CHARS = "aaa";
function RandStr() {
  var c = Math.floor(Math.random() * CHARS.length);
}
function RandVal() { 
  return RandBool() ? RandStr() : RandStr(); 
}
function GenerateSpecPermutes(matchVals, resultArray) {
    var maxPermuteBody = (1 << matchVals.length) - 1;
    for(var bod_pm = 0; bod_pm <= maxPermuteBody; bod_pm++)
      for(var k = 0; k < matchVals.length; k++)
        var body = ((bod_pm & (1 << k)) > 0) ? null : RandVal();
}
GenerateSpecPermutes(["foo", "bar", "zing"]);
S-s due to infer failure, CCing IonMonkey team.
Whiteboard: [jsbugmon:update,bisect]
Blocks: IonFuzz
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update,reconfirm,bisect]
Whiteboard: [jsbugmon:update,reconfirm,bisect] → [jsbugmon:update,reconfirm,ignore]
JSBugMon: This bug has been automatically confirmed to be still valid (reproduced on revision aa5e3b445810).
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   109435:64bf5f240ccb
user:        Sean Stangl
date:        Fri Oct 05 12:05:21 2012 -0700
summary:     Bug 797551 - Use callWithABI() for Math.random(). r=dvander

This iteration took 100.125 seconds to run.
Assignee: general → sstangl
Whiteboard: [jsbugmon:update,reconfirm,ignore] → [jsbugmon:update,reconfirm,ignore][ion:p1]
[Approval Request Comment]
Bug caused by (feature/regressing bug #): 797551
User impact if declined: Unlikely crashes
Testing completed (on m-c, etc.): on m-i
Risk to taking this patch (and alternatives if risky): none
String or UUID changes made by this patch: none
Attachment #669732 - Flags: review?(dvander)
Attachment #669732 - Flags: approval-mozilla-aurora?
Comment on attachment 669732 [details] [diff] [review]
Confer with TI about the return type of Math.random().

Review of attachment 669732 [details] [diff] [review]:
-----------------------------------------------------------------

r=me with the test case included, if possible
Attachment #669732 - Flags: review?(dvander) → review+
Comment on attachment 669732 [details] [diff] [review]
Confer with TI about the return type of Math.random().

Please refrain from nominating for uplift before landing on m-c.
Attachment #669732 - Flags: approval-mozilla-aurora?
https://hg.mozilla.org/mozilla-central/rev/315e66e6b2ae
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla19
Status: RESOLVED → VERIFIED
JSBugMon: This bug has been automatically verified fixed.
Comment on attachment 669732 [details] [diff] [review]
Confer with TI about the return type of Math.random().

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 797551
User impact if declined: Unlikely crashes
Testing completed (on m-c, etc.): on m-i
Risk to taking this patch (and alternatives if risky): none
String or UUID changes made by this patch: none
Attachment #669732 - Flags: approval-mozilla-aurora?
Comment on attachment 669732 [details] [diff] [review]
Confer with TI about the return type of Math.random().

Approving the patch on aurora as the fix will avoid unlikely crashes and is low risk .
Attachment #669732 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
Whiteboard: [jsbugmon:update,reconfirm,ignore][ion:p1] → [jsbugmon:update,reconfirm,ignore][ion:p1][adv-main18-]
Group: core-security
You need to log in before you can comment on or make changes to this bug.