920028 - Assertion failure: conversion != MToDouble::NumbersOnly, at jit/Lowering.cpp:1580

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 1fda74e33e06 (run with --fuzzing-safe):


function f0(p0) {
    do {} while (true + 0 > p0);
}
f0(.61);

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/c2aa14f70497
user:        Brian Hackett
date:        Tue Aug 06 15:11:56 2013 -0600
summary:     Bug 902009 - Fold ToDouble(ToInt32(v)) conversions, r=jandem.

This iteration took 329.600 seconds to run.

Comment 3

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Brian, is bug 902009 a likely regressor?

Comment 5

[Brian Hackett [Laid off!]]

Attachment: patch

When folding ToDouble(ToInt32(x)) the ToDouble can tolerate any input which the ToInt32 would have.

Comment 6

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0fe9f2f83046

Comment 7

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/0fe9f2f83046