842425 - IonMonkey: Assertion failure: JSVAL_IS_DOUBLE_IMPL(l), at js/Value.h:364

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 0acbd06d48a9 (run with --ion-eager):


function g() {
  var a = [];
  for (var i = 0; i < 10; i++)
    a.push(i, 1.5);
  for (var i = 0; i < 32 ; i++)
    a[i].m = function() {} 
}
g();

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   120310:d7dd65663469
user:        Brian Hackett
date:        Tue Jan 29 16:20:03 2013 -0700
summary:     Bug 833898 - Allow converting mixed arrays of ints and doubles to uniform doubles, r=jandem.

This iteration took 103.268 seconds to run.

Comment 2

[Christian Holler (:decoder)]

Ccing bhackett based on comment 1.

Comment 3

[Brian Hackett [Laid off!]]

Attachment: patch

array_push used a path that would add elements to an array without checking if integer elements needed conversion to doubles.  This is the only caller of copyDenseElements.

Comment 4

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/cd16203968a5

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/cd16203968a5