872331 - Assertion failure: conversion != MToDouble::NumbersOnly && conversion != MToDouble::NonNullNonStringPrimitives, at ion/Lowering.cpp:1395

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 81dd97739fa1 (run with --ion-eager):


var msPerYear =  31536000000;
function IgnoreDaylightSaving(t) {
  msPerYear <= t && t < 2*msPerYear && !DST_1971
}
addTestCase( (new Date()).valueOf() );
addTestCase( undefined );
function addTestCase( t ) {
  IgnoreDaylightSaving(null);
  IgnoreDaylightSaving(t+1);
}

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 3

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision bd9a40076aa6).
JSBugMon: Bisection requested, failed due to error (try manually).

Comment 4

[Christian Holler (:decoder)]

New test for revision 4e5983de6e3b:


DaylightSavingTA((new Date()).valueOf())
function DaylightSavingTA(t) {
  if (t >= undefined) {}
}
SetFullYear();
SetFullYear();
function SetFullYear() {
  DaylightSavingTA((undefined, null));
}

Comment 5

[Jesse Ruderman]

Simpler testcase, without Date and the serial-expression comma:

function d(t) {
  if (t >= undefined) {}
}
function s() {
  d(null);
}
d(3);
s();
s();

Comment 6

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/909360229cff
user:        Brian Hackett
date:        Mon Apr 29 13:10:00 2013 -0600
summary:     Bug 865431 - Restrict Compare_Double and related comparisons to inputs where they will produce the correct result, r=jandem.

This iteration took 142.047 seconds to run.

Comment 7

[Jan de Mooij [:jandem]]

needinfo? from Brian per comment 6.

Comment 8

[Brian Hackett [Laid off!]]

Attachment: patch

Somehow I thought checking for MIRType_Null wasn't necessary here, but I don't remember why.

Comment 9

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/7a57827dc0a2

Comment 10

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/7a57827dc0a2

Comment 11

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature