847430 - IonMonkey: Assertion failure: obj, at ./dist/include/js/Value.h:712

Status: RESOLVED DUPLICATE of bug 848733

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision f99a075a5bce (no options required):


test();
function test() {
    var n = 1000000;
    var i=0;
    var mceil = Math.floor;
    var msqrt = Math.sqrt;
    for (i = 3; i<= n; i+=/x/) {
      limit = mceil(msqrt(i)+1) + 1;
      for (j = 3; j < limit; j+=2) {}
    }
    var end = new Date();
}

Comment 1

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision eccf45749400).
JSBugMon: Bisection requested, failed due to error (try manually).

Comment 2

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision dfeacbbb793d).
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   124108:814a0c94b215
user:        Jan de Mooij
date:        Thu Mar 07 14:38:09 2013 +0100
summary:     Bug 848733 - Don't eliminate callee phi when inlining natives. r=bhackett

This iteration took 116.108 seconds to run.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

jandem, is bug 848733 a likely fix?

Comment 4

[Jan de Mooij [:jandem]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #3)
> jandem, is bug 848733 a likely fix?

Yeah, it's the same issue.