906024 - Assertion failure: output.type() == MIRType_Int32, at jit/IonCaches.cpp:1024 or Crash [@ ToPrimitive]

Status: RESOLVED DUPLICATE of bug 906035

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 1ed5a88cd4d0 (run with --fuzzing-safe --ion-eager):


function y() { return "foo,bar"; }
function x() {
  var z = y().split(',');
  for (var i = 0; i < z.length; i++) {}
}
gczeal(2);
Object.prototype.length = function () {};
x();

Comment 1

[Christian Holler (:decoder)]

Actually this should be a security-bug because gczeal is involved and we're crashing after confusing some types.

Comment 2

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/42776e928f7b
user:        Eric Faust
date:        Sat Aug 10 22:20:36 2013 -0700
summary:     Bug 902264 - Part 2: Expose Array.length optimization to idempotent GetPropertyICs. (r=jandem)

This iteration took 0.737 seconds to run.

Comment 4

[Andrew McCreight (out of office until 8/21) [:mccr8]]

Can you look at this Eric?  Thanks.

Comment 5

[Andrew McCreight (out of office until 8/21) [:mccr8]]

Over IRC, efaust said this is probably a dupe of something he has an unlanded patch for, so I'm just going to assign it to him, and decoder's robots can confirm this, or something.

Comment 6

[Eric Faust [:efaust]]

This is indeed a dupe of 906035, with the same assertion.