809509 - IonMonkey: Assertion failure: iter->getOffset() >= perforation.getOffset(), at ../ion/shared/IonAssemblerBufferWithConstantPools.h:710

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 98b004c70db0 (run with --ion-eager):


test();
function test() {
  enterFunc ('test');
  unescape("1234");
  var x = [];
  var n = [
	27875, 25925, 30422, 12227, 27798, 
	32170, 10873, 75.2 , 30629, 26296, 
	20697, 5125, 4815, 2221, 14392, 
	23369, 5560, 2, 0, 0
	];
  var expected = [
	18770, 31456, 17999, 32635, 27508, 
	29131, 2856, 16233, (.2), 27580, 
	7093, 18192, 30804, 5472, 8529, 
	28649, 14852, 0, 0, 0
  ];
  bpe=0;
  for (bpe=0; (1<<(bpe+1)) > (1<<bpe); bpe++);
}

Comment 1

[Christian Holler (:decoder)]

S-s until investigated because this is a range assertion.

Comment 2

[Andrew McCreight [:mccr8]]

Marking sec-high due to range assertion. Please adjust up-or-down as needed.

Comment 3

[Sean Stangl [:sstangl]]

On tip, this now yields the same assert as Bug 854462. Marking a dependency so we can check whether it's a duplicate after Bug 854462 is resolved.

Comment 4

[Christian Holler (:decoder)]

I cannot reproduce this anymore on m-c, but I guess the developer working on bug 854462 should also check that this issue here is the same, so leaving this open for now.

Comment 5

[Jan de Mooij [:jandem]]

I'm looking at old security bugs. Is this still an issue? Thanks!

Comment 6

[Al Billings [:abillings - ex-MoCo]]

Decoder, does this still not reproduce?

Comment 7

[Christian Holler (:decoder)]

This doesn't reproduce for me anymore either. I also haven't seen it popping up during fuzzing. Marking WFM.