916752 - Assertion failure: outputType == MIRType_Value, at jit/Lowering.cpp:1961 with GC

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision dc909122bcf5 (run with --fuzzing-safe --ion-eager):


function test() { return "x,y,z"; };
function testClear() {
  test().split(',');
}
loadFile("1");
loadFile("testClear();");
loadFile("2");
loadFile("gc();");
loadFile("testClear();");
loadFile("new test(0);");
function loadFile(lfVarx) {
        if (lfVarx.substr(-3) != ".js" && lfVarx.length != 1) {
            switch (lfRunTypeId) {
                case 2: new Function(lfVarx)(); break;
                default: evaluate(lfVarx); break;
            }
        } else if (!isNaN(lfVarx)) {
            lfRunTypeId = parseInt(lfVarx);
    }
}

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/a1bd3bb5a0ba
user:        Hannes Verschore
date:        Fri Sep 06 15:10:54 2013 +0200
summary:     Bug 909717: IonBuilder: Introduce typed typebarriers, r=jandem

This iteration took 1.370 seconds to run.

Comment 3

[Hannes Verschore [:h4writer]]

Attachment: bug916752-asserts

Interesting we didn't had a testcase exercising this path in the testsuite. This is again bogus asserts. When we are definitely bailing the type is changed to the input type (not to MIRType_Value).

Comment 4

[Hannes Verschore [:h4writer]]

@decoder: This bug may get opened. Is not security sensitive.

Comment 5

[Hannes Verschore [:h4writer]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e21c1e60414f

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/e21c1e60414f

Comment 8

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature