975290 - Assertion failure: specialization_ == MIRType_Int32 || specialization_ == MIRType_Double, at jit/TypePolicy.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

for (var j = 0; j < 9999; ++j) {
    (function() {
        Math.pow(Math.fround(), Math.fround(0))
    })();
}

asserts js debug shell on m-c changeset 7010ab83a06e without any CLI arguments at Assertion failure: specialization_ == MIRType_Int32 || specialization_ == MIRType_Double, at jit/TypePolicy.cpp

This is occurring very often, setting [fuzzblocker].

My configure flags are:

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-exact-rooting --with-ccache --disable-threadsafe

=== Tinderbox Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20140220095927" and the hash "25168278f39a".
The "bad" changeset has the timestamp "20140220102129" and the hash "7a5cbe4dadf8".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=25168278f39a&tochange=7a5cbe4dadf8

Bug 930477 is the only bug in the regression window, setting needinfo? from Benjamin.

Comment 1

[Benjamin Bouvier [:bbouvier] (inactive)]

Thanks for the report! It was also the cause of the massive regression in Octane-mandreel on AWFY.
Fixed in bug 930477 (I've added your test case there).