905986 - Assertion failure: in->type() == MIRType_Double, at jit/IonAnalysis.cpp:542

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 1ed5a88cd4d0 (run with --fuzzing-safe --ion-eager):


function testPartition() {
  if(0.1 || new testPartition()) {}
}
testPartition();

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Andrew McCreight [:mccr8]]

Is there a regressing changeset for this?

Could some IM person look at this?  It has sat here for about a week.

Comment 3

[Jesse Ruderman]

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/471dcc138dfe
user:        Shu-yu Guo
date:        Fri Aug 02 08:24:56 2013 -0700
summary:     Bug 898576 - Ignore cold phi inputs when specializing phi types.

Comment 4

[Shu-yu Guo [:shu]]

Probably my fault, I'll take this.

Comment 5

[Shu-yu Guo [:shu]]

Attachment: fix + testcase

This is because the special double case for specializing phis wasn't updated correctly to understand the new phi type specialization.

Fold the special double case into the general case in adjustPhiInputs, converting int32 operands to doubles all the time.

Comment 6

[Jan de Mooij [:jandem]]

Comment on attachment 796390 [details] [diff] [review]
fix + testcase

Review of attachment 796390 [details] [diff] [review]:
-----------------------------------------------------------------

Nice catch.

Comment 7

[Jan de Mooij [:jandem]]

We should land this on aurora as well.

Comment 8

[Andrew McCreight [:mccr8]]

Sounds kind of bad.  Feel free to upgrade if it is really bad or whatever.

Comment 9

[Shu-yu Guo [:shu]]

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/65599e610d98

Comment 10

[Shu-yu Guo [:shu]]

Comment on attachment 796390 [details] [diff] [review]
fix + testcase

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 898576
User impact if declined: Possible exploit in JIT code
Testing completed (on m-c, etc.): Waiting on m-c
Risk to taking this patch (and alternatives if risky): None
String or IDL/UUID changes made by this patch:

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/65599e610d98

Comment 12

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 13

[Ryan VanderMeulen [:RyanVM]]

Needs a branch-specific patch for uplift.

Comment 14

[Shu-yu Guo [:shu]]

Attachment: aurora patch

This incorporates bug 901391, which wasn't uplifted and is thus causing the conflict.

Comment 15

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/a6d32f0d4147