Closed Bug 799804 Opened 12 years ago Closed 9 years ago

IonMonkey: Assertion failure: newRange->lower() >= oldRange.lower(), at ion/RangeAnalysis.h:194

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 799282

People

(Reporter: decoder, Unassigned)

References

Details

(Keywords: assertion, testcase, Whiteboard: [ion:t] [jsbugmon:]) 

The following testcase asserts on mozilla-central revision 22d192c5d1fd (no options required):


function arityMismatchMissingArg(arg) {
  for (var a = 0, i = 1; i < 10000; i >>=  2) {
    a = i;
  }
  return a;
}
function arityMismatchExtraArg() {
  return arityMismatchMissingArg(1, 2);
}
assertEq(arityMismatchExtraArg(), 16383);
Blocks: IonFuzz
Whiteboard: [jsbugmon:update,bisect]
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   109621:c0b305197227
user:        Marty Rosenberg
date:        Tue Oct 02 04:34:28 2012 -0400
summary:     Teach RangeAnalysis how to deal with unreachable blocks (bug 765119, r=dvander)

This iteration took 86.549 seconds to run.
Whiteboard: [jsbugmon:update] → [jsbugmon:update][ion:p1]
related to bug 799282 ?
Whiteboard: [jsbugmon:update][ion:p1] → [ion:p1] [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 2fae8bd461da).
Whiteboard: [ion:p1] [jsbugmon:update,ignore] → [ion:p1] [jsbugmon:bisectfix]
Whiteboard: [ion:p1] [jsbugmon:bisectfix] → [ion:p1] [jsbugmon:]
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   109839:41c4510e6635
user:        Marty Rosenberg
date:        Wed Oct 10 01:25:03 2012 -0400
summary:     Change the method we use to update ranges on phis so narrowing works properly (bug 799282, r=jandem)

This iteration took 109.712 seconds to run.
This is a dup of bug 799282 as Tomcat suggested already. However, I think Marty will want to include the testcase from this bug, so leaving this open for now.
Whiteboard: [ion:p1] [jsbugmon:] → [ion:t] [jsbugmon:]
needinfo per comment 5.
Flags: needinfo?(mrosenberg)
Assignee: general → nobody
The testcase is old and is an infinite loop, so we should not take it. Clearing request and resolving bug.
Status: NEW → RESOLVED
Closed: 9 years ago
Flags: needinfo?(marty.rosenberg)
Resolution: --- → FIXED
Resolution: FIXED → DUPLICATE
You need to log in before you can comment on or make changes to this bug.