932393 - Assertion failure: outputType == MIRType_Value, at jit/Lowering.cpp:1967

Status: RESOLVED DUPLICATE of bug 916752

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-beta revision d0248e4d4357 (threadsafe build, run with --fuzzing-safe --ion-eager --ion-regalloc=backtracking):


function reportCompare () {}
reportCompare();
function footest() {
new reportCompare();
var o = { toString: function() {} };
expect = o.toString();
} footest();

Comment 1

[Christian Holler (:decoder)]

This is beta only (possibly aurora, haven't tried) and I got the options messed up, actually --ion-eager suffices. It could be that we fixed this problem already and either forgot to uplift, or it's not a security problem and we did not bother to uplift. I was not able to find the specific bug though.

Hannes, can you take a look?

Comment 2

[Christian Holler (:decoder)]

Per comment 1.

Comment 3

[Hannes Verschore [:h4writer]]

This is bug 916752, bogus assert. That's probably the reason I didn't uplift. Should I or can I just ignore?

Comment 4

[Christian Holler (:decoder)]

Yes, we can mark it as duplicate then.