Closed Bug 866826 Opened 7 years ago Closed 7 years ago

Assertion failure: id == IdToTypeId(id), at ../jsinferinlines.h:1607

Categories

(Core :: JavaScript Engine, defect, critical)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla23

People

(Reporter: decoder, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update])

Attachments

(1 file)

The following testcase asserts on mozilla-central revision 05533d50f2f7 (run with --ion-eager):


function x() {}
var obj = new Function();
for (var i = 0; i < 100; i++) {
    obj['-1'] = x;
    obj['-1'] == "";
}
Whiteboard: [jsbugmon:update,bisect]
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   129593:ee14945b452c
parent:      128511:d989eab66df4
user:        Brian Hackett
date:        Thu Apr 11 18:39:32 2013 -0600
summary:     Bug 804676 - Remove dependence of Ion compilation on ScriptAnalysis::analyzeTypes.

This iteration took 12.099 seconds to run.

Oops! We didn't test rev d989eab66df4, a parent of the blamed revision! Let's do that now.
Rev d989eab66df4: Found cached shell...   Testing... [Uninteresting] It didn't crash. (0.735 seconds)
good (not interesting) 
As expected, the parent's label is the opposite of the blamed rev's label.
Brian, can you take a look? :)
Attached patch patchSplinter Review
Attachment #744188 - Flags: review?(dvander)
Attachment #744188 - Flags: review?(dvander) → review+
https://hg.mozilla.org/mozilla-central/rev/39aad6551764
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla23
You need to log in before you can comment on or make changes to this bug.