894727 - Assertion failure: a.isGeneralReg(), at ion/shared/CodeGenerator-shared-inl.h

Status: RESOLVED DUPLICATE of bug 893732

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

x = new Uint8Array(ArrayBuffer(36), 18);
var y = [];
for (var z = 0; z < 99; z++) {
    Array.prototype.unshift.call(y, x);
};
Array.prototype.sort.call(y, Array.indexOf.bind());

asserts the following js debug shell on m-c changeset 0888e29c83a3 without any CLI arguments at Assertion failure: a.isGeneralReg(), at ion/shared/CodeGenerator-shared-inl.h

https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-win32-debug/1374007345/jsshell-win32.zip

I can't reproduce the original unreduced testcase on Mac yet, so I don't know how bad this is. Will attempt to run autoBisect.

Comment 1

[Christian Holler (:decoder)]

Likely a dup of bug 893732.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Christian Holler (:decoder) from comment #1)
> Likely a dup of bug 893732.

Hmm, you're likely right. I wonder why bugzilla's dupe bug search didn't cause that bug to show up.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/0670cdaf7e9c
user:        Brian Hackett
date:        Thu Jul 11 15:08:26 2013 -0600
summary:     Bug 891400 - Improve pattern matching on static typed array accesses, r=jandem.

Brian, perhaps you could open this one up if it isn't s-s.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Likely not s-s because bug 893732 isn't s-s, so opening up.