Closed Bug 973620 Opened 10 years ago Closed 10 years ago

Assertion failure: consumer->isConsistentFloat32Use(), at jit/IonAnalysis.cpp:979 or Crash [@ js::jit::LIRGenerator::visitToString]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
ARM
Linux
Type:
defect
Priority:
Not set
Severity:
major

Tracking

()

Status:
RESOLVED DUPLICATE of bug 966926

People

(Reporter: decoder, Unassigned)

References

Details

(Keywords: assertion, testcase) 

The following testcase asserts on mozilla-central revision f6ab28f98ee5 (x86 ARM simulator build, run with --fuzzing-safe):


setJitCompilerOption("ion.usecount.trigger", 1);
var f32 = new Float32Array(32);
function f(n) {
    var x;
    if (n > 10000) {
        x = 4.5;
    } else {
        x = f32[0];
    }
    f32[0] = "" + x;
}
for (var n = 0; n < 50; n++)
  f(n);
I thought I reported this one already, but seems like I didn't :)
No longer blocks: IonFuzz
Blocks: 959597
decoder said the build may be older than the revision in comment 0 and according to Benjamin it looks like bug 966926.
Ah thanks. I remembered I had seen this before.
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → DUPLICATE
Group: core-security → core-security-release
Group: core-security-release
Assignee: general → nobody
QA Contact: general
You need to log in before you can comment on or make changes to this bug.