816394 - Assertion failure: [infer failure] Missing type pushed 0: [0x102316970]

Status: RESOLVED DUPLICATE of bug 811566

(Core :: JavaScript Engine, defect)

Description

[Norbert Lindenberg]

A try run with several patches for bug 769872 is showing a number of failures with "Assertion failure: [infer failure] Missing type pushed 0: [0x102316970], at ../../../js/src/jsinfer.cpp:315" (the hex number varies). The failures occur on Linux, Mac, and Windows; the failing tests appear not to be run on other platforms.

Steps to reproduce with the js shell:

- start with mozilla-central rev 17c267a881cf (others may work)

- install the four patches used in the try run
  https://tbpl.mozilla.org/?tree=Try&rev=93b5aa7239bb
i.e.:
  https://hg.mozilla.org/try/raw-rev/050721ad46af
  https://hg.mozilla.org/try/raw-rev/dc5f5e7c31af
  https://hg.mozilla.org/try/raw-rev/c9809d187ceb
  https://hg.mozilla.org/try/raw-rev/bdb76d3025ee

- build a debug version

- run the following tests with "js --no-ion -a":
js/src/jit-test/tests/basic/bug547911-1.js
js/src/jit-test/tests/basic/bug627692-2.js
js/src/jit-test/tests/basic/bug638981.js
js/src/jit-test/tests/basic/bug642772-1.js
js/src/jit-test/tests/basic/bug642772-3.js
js/src/jit-test/tests/basic/bug650148.js
js/src/jit-test/tests/basic/bug653262.js
js/src/jit-test/tests/basic/bug654073.js
js/src/jit-test/tests/basic/bug662562.js
js/src/jit-test/tests/basic/bug702426-regexp-gc.js
js/src/jit-test/tests/basic/bug737384.js
js/src/jit-test/tests/basic/bug767074.js
js/src/jit-test/tests/basic/testBug584650.js
js/src/jit-test/tests/basic/testBug606138.js
js/src/jit-test/tests/basic/testBug634590.js
js/src/jit-test/tests/basic/testBug634590b.js
js/src/jit-test/tests/basic/testBug634590c.js
js/src/jit-test/tests/basic/testBug634590d.js
js/src/jit-test/tests/basic/testBug634590ma.js
js/src/jit-test/tests/basic/testBug780288-1.js
js/src/jit-test/tests/basic/testBug780288-2.js
js/src/jit-test/tests/basic/testBug780712.js
js/src/jit-test/tests/basic/testDefinePropertyAcrossCompartment.js
js/src/jit-test/tests/basic/testInterpreterReentry2.js
js/src/jit-test/tests/basic/testInterpreterReentry3.js
js/src/jit-test/tests/basic/testIteratorReification.js
js/src/jit-test/tests/basic/testOOMInAutoEnterCompartment.js
js/src/jit-test/tests/basic/testThrowWhileWrappingException.js
js/src/jit-test/tests/collections/Set-iterator-gc-2.js
js/src/jit-test/tests/debug/Environment-identity-03.js
js/src/jit-test/tests/e4x/bug613151.js
js/src/jit-test/tests/ion/bug724654.js
js/src/jit-test/tests/ion/bug770235.js
js/src/jit-test/tests/ion/bug808023.js
js/src/jit-test/tests/ion/setgname-reconfigured.js
js/src/jit-test/tests/jaeger/bug588363-2.js
js/src/jit-test/tests/jaeger/bug663485.js
js/src/jit-test/tests/jaeger/bug719758.js
js/src/jit-test/tests/pic/callname-eager-this1.js
js/src/jit-test/tests/pic/callname-eager-this2.js

The assertion failure appears to always occur in the self-hosted function intl_CanonicalizeLanguageTag, near the call tagMappings.hasOwnProperty(locale).

These two showed the same assertion in the try run, but failed with different error messages when run in the shell:
js/src/jit-test/tests/e4x/bug737251.js
js/src/jit-test/tests/e4x/bug753885-2.js