867100 - IonMonkey: Assertion failure: false (unexpected jsval type), at ../ion/IonTypes.h:121 or Assertion failure: l.asBits <= JSVAL_SHIFTED_TAG_MAX_DOUBLE, at ../dist/include/js/Value.h:593 with GC

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 1eb382609c2d (run with --ion-eager):


var addexp = 0;
  for ( addpow = 0; addpow < 33; addpow++ ) {
    addexp += Math.pow(2, addpow);
    ToInt32(addexp);
}
function ToInt32( n ) {
  var sign = ( n < 0 ) ? -1 : 1;
  n = (sign * Math.floor( Math.abs(n) )) % 5e-324;
  for ( p = 30; p >=0; p-- ) {}
}

Comment 1

[Christian Holler (:decoder)]

I get the second assertion if I replace the for-loop in ToInt32 with a gc:

var addexp = 0;
  for ( addpow = 0; addpow < 33; addpow++ ) {
    addexp += Math.pow(2, addpow);
    ToInt32(addexp);
}
function ToInt32( n ) {
  var sign = ( n < 0 ) ? -1 : 1;
  n = (sign * Math.floor( Math.abs(n) )) % 5e-324;
  gc();
}


Marking this s-s because it seems to involve GC.

Comment 2

[Christian Holler (:decoder)]

Also note that the original assertion here was "Assertion failure: (ptrBits & 0x7) == 0" which usually indicates a security problem.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 4

[Andrew McCreight [:mccr8]]

Does this still reproduce, decoder?

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Retrying JSBugMon to see if this is still reproduceable.

Comment 6

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 7

[Christian Holler (:decoder)]

Sorry for the delay. None of the tests above reproduce for me anymore. I'll mark this WFM :)