867820 - IonMonkey: Assertion failure: conversion != MToDouble::NumbersOnly, at ion/Lowering.cpp:1403

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 02aa81c59df6 (run with --ion-eager):


function AddTestCase(expect, actual) {
  new TestCase(expect, actual);
}
function TestCase(e, a) {
  this.expect = e;
  getTestCaseResult(e, a);
}
function getTestCaseResult(expected, actual) {
  if (actual != expected) {}
}
AddRegExpCases(false, Math.pow(2,31));
AddRegExpCases("", Math.pow(2,30) - 1);
function AddRegExpCases(m, l) {
  AddTestCase("");
  AddTestCase(m, true);
  AddTestCase(l, 0);
}

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   130267:909360229cff
user:        Brian Hackett
date:        Mon Apr 29 13:10:00 2013 -0600
summary:     Bug 865431 - Restrict Compare_Double and related comparisons to inputs where they will produce the correct result, r=jandem.

This iteration took 121.339 seconds to run.

Comment 2

[Christian Holler (:decoder)]

Ccing Brian based on comment 1.

Comment 3

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 4

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 5

[Brian Hackett [Laid off!]]

Attachment: patch

I think this assert was mostly wishful thinking.

Comment 6

[Jan de Mooij [:jandem]]

Comment on attachment 753276 [details] [diff] [review]
patch

Review of attachment 753276 [details] [diff] [review]:
-----------------------------------------------------------------

Would be good to add the testcase in comment 0.

Comment 7

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/5c1ec2478ab6

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/5c1ec2478ab6