930990 - Assertion failure: consumer->isConsistentFloat32Use(), at jit/IonAnalysis.cpp:933

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 5a9ac6fed6ff (run with --fuzzing-safe --ion-eager):


do {} while (Math.fround(Math.random()));

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: bug930990.patch

Slightly changed the test so that it doesn't iloop when working.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/03fdc9e5eea3
user:        Benjamin Bouvier
date:        Tue Oct 22 14:51:37 2013 +0200
summary:     Bug 913282: More Float32 operators: comparisons; p=dougc,bbouvier, r=jonco,h4writer

This iteration took 10.817 seconds to run.

Comment 4

[Benjamin Bouvier [:bbouvier] (inactive)]

And once again, my edge connection is not enough to push :/

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/9fbd0d6598a7

Comment 6

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/9fbd0d6598a7