799804 - IonMonkey: Assertion failure: newRange->lower() >= oldRange.lower(), at ion/RangeAnalysis.h:194

Status: RESOLVED DUPLICATE of bug 799282

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 22d192c5d1fd (no options required):


function arityMismatchMissingArg(arg) {
  for (var a = 0, i = 1; i < 10000; i >>=  2) {
    a = i;
  }
  return a;
}
function arityMismatchExtraArg() {
  return arityMismatchMissingArg(1, 2);
}
assertEq(arityMismatchExtraArg(), 16383);

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   109621:c0b305197227
user:        Marty Rosenberg
date:        Tue Oct 02 04:34:28 2012 -0400
summary:     Teach RangeAnalysis how to deal with unreachable blocks (bug 765119, r=dvander)

This iteration took 86.549 seconds to run.

Comment 2

[Carsten Book [:Tomcat]]

related to bug 799282 ?

Comment 3

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 2fae8bd461da).

Comment 4

[Christian Holler (:decoder)]

JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   109839:41c4510e6635
user:        Marty Rosenberg
date:        Wed Oct 10 01:25:03 2012 -0400
summary:     Change the method we use to update ranges on phis so narrowing works properly (bug 799282, r=jandem)

This iteration took 109.712 seconds to run.

Comment 5

[Christian Holler (:decoder)]

This is a dup of bug 799282 as Tomcat suggested already. However, I think Marty will want to include the testcase from this bug, so leaving this open for now.

Comment 6

[Christian Holler (:decoder)]

needinfo per comment 5.

Comment 7

[Sean Stangl [:sstangl]]

The testcase is old and is an infinite loop, so we should not take it. Clearing request and resolving bug.