831055 - "Assertion failure: [infer failure] Missing type in object [0x241d1f0] lastIndex: float,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

r = RegExp("(?!})()?", "g");
r.test();
r.lastIndex;

asserts js debug shell on m-c changeset 56ff556e74d9 with -a at Assertion failure: [infer failure] Missing type in object [0x241d1f0] lastIndex: float,

Tested on 64-bit. s-s because this is an inference failure.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   116119:b7e2ba73b2ff
user:        Sean Stangl
date:        Wed Dec 12 18:11:28 2012 -0800
summary:     Bug 808245, Part 6/6 - Add MatchOnly mode and lazify RegExpStatics.
 r=dvander

Comment 1

[Sean Stangl [:sstangl]]

This is probably another instance of Bug 826581. Anything involving search(), test(), or replace() will have random behavior on Win64 until that bug is fixed.

Comment 2

[Sean Stangl [:sstangl]]

That should read "Bug 826588".

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 4

[Andrew McCreight [:mccr8]]

Marking as moderate because it is probably Win64 only.

Comment 5

[Sean Stangl [:sstangl]]

Gary, this also should have been fixed by Makoto's recent patch in Bug 830676.

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I verify that the assertion no longer occurs with the testcase. Setting in-testsuite? and assuming fixed by bug 830676.

Comment 7

[Daniel Veditz [:dveditz]]

Can we land 830676 on Aurora? This bug occurs on at least Firefox 20 based on when it was filed.

Comment 8

[Daniel Veditz [:dveditz]]

of course bug 830676 claims it's fixing a regression in Firefox 21 so it's not clear how it fixed this older bug. Maybe there's a part of it to back-port?

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Sean, does the patch in bug 830676 need to be backported to Aurora?

I marked this bug as affecting 20 but bug 830676 (which fixes this bug) is set as not affecting 20.

Comment 10

[Sean Stangl [:sstangl]]

(In reply to Gary Kwong [:gkw] (intermittent Feb 8 - Feb 19) from comment #9)
> Sean, does the patch in bug 830676 need to be backported to Aurora?
> 
> I marked this bug as affecting 20 but bug 830676 (which fixes this bug) is
> set as not affecting 20.

Aurora is affected by Bug 830676. I'll set the bits.

Comment 11

[Lukas Blakk [:lsblakk] use ?needinfo]

Bug 830676 got uplifted and marked fixed on FF 20 - is there anything left here to do for FF 20?

Comment 12

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Lukas Blakk [:lsblakk] from comment #11)
> Bug 830676 got uplifted and marked fixed on FF 20 - is there anything left
> here to do for FF 20?

Nope. I verified that it has been fixed for FF 20 (mozilla-beta now).