850635 - IonMonkey: Assertion failure: [infer failure] Missing type pushed 0: int, at jsinfer.cpp:315

Status: RESOLVED DUPLICATE of bug 847412

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision c1a5c44ae3d8 (run with --ion-eager):


new Object1('true,111,0.5');
function Object1(value) {
  this.array = value.split(",");
  this.length = this.array.length;
  for ( var i = 0; i < this.length; i++)
    this[i] = eval(this.array[i]);
}

Comment 1

[Christian Holler (:decoder)]

S-s due to infer failure. There are other infer failure bugs open, but I'll let this bisect first before deciding to dupe. Also the test here looks simpler than some of the other bugs we have on file.

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, failed due to error (try manually).

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
Due to skipped revisions, the first bad revision could be any of:
changeset:   122543:5b0002d4b427
user:        Brian Hackett
date:        Thu Feb 21 06:46:46 2013 -0700
summary:     Bug 842424 - Add missing newKind, r=terrence.

changeset:   122544:985efc588a5e
user:        Mark Finkle
date:        Thu Feb 21 08:52:37 2013 -0500
summary:     Bug 843361 - Dump list of open files if we fail to unlock the DB r=blassey

changeset:   122545:cd16203968a5
user:        Brian Hackett
date:        Thu Feb 21 06:54:16 2013 -0700
summary:     Bug 842425 - Watch for arrays that need elements converted to doubles when pushing elements, r=jandem.

changeset:   122546:0ded3af9b2d7
user:        Brian Hackett
date:        Thu Feb 21 06:56:54 2013 -0700
summary:     Bug 743394 - Ion compile JSOP_EVAL, r=jandem.

changeset:   122547:48c067a87ba2
user:        Brian Hackett
date:        Thu Feb 21 07:02:41 2013 -0700
summary:     Bug 842424 - Remove assertion.

This iteration took 1.893 seconds to run.

Comment 4

[Christian Holler (:decoder)]

Needinfo from Brian, based on comment 3 :)