Closed Bug 843875 Opened 10 years ago Closed 10 years ago

IonMonkey: Assertion failure: [infer failure] Missing type pushed 0: float, at jsinfer.cpp:314

Categories

(Core :: JavaScript Engine, defect)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla22

People

(Reporter: decoder, Assigned: bhackett1024)

References

Details

(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update])

Attachments

(1 file)

The following testcase asserts on mozilla-central revision d57a813c77a4 (run with --ion-eager):


function writeHeaderToLog( string ) { }
var input = [ 0xfffffff0, 101 ];
var arr = new Uint32Array(input.length);
var expected = [ 0xffffffff, 101 ];
for (var i=0; i<arr.length; i++) {
  arr[i] = writeHeaderToLog[i] = expected[i] = i * 8;
}
S-s because infer failures can be security related.
Blocks: IonFuzz
Whiteboard: [jsbugmon:update,bisect]
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   120310:d7dd65663469
user:        Brian Hackett
date:        Tue Jan 29 16:20:03 2013 -0700
summary:     Bug 833898 - Allow converting mixed arrays of ints and doubles to uniform doubles, r=jandem.

This iteration took 0.603 seconds to run.
bhackett says this (and other bugs caused by bug 833898) are not s-s because they only lead to a confusion between double and int. Opening up and needinfo on Brian :)
Group: core-security
Flags: needinfo?(bhackett1024)
Attached patch patchSplinter Review
During Ion compilation the wrong value was pushed back on the stack if a double conversion was needed for the value being written to the array.
Assignee: general → bhackett1024
Attachment #717143 - Flags: review?(jdemooij)
Flags: needinfo?(bhackett1024)
Attachment #717143 - Flags: review?(jdemooij) → review+
https://hg.mozilla.org/mozilla-central/rev/1b88a261e304
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla22
You need to log in before you can comment on or make changes to this bug.