984344 - Assertion failure: IsCompatibleLIRCoercion(def->type(), as->type()), at jit/shared/Lowering-shared-inl.h:195

Status: RESOLVED DUPLICATE of bug 995166

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 25cfa01ba054 (run with --fuzzing-safe --ion-compile-try-catch --ion-check-range-analysis --ion-eager):


function exitFunc (funcName) {
  if (funcName)
      funcName += "()";
}
test();
function test()
  exitFunc ('test');
evaluate("exitFunc(new exitFunc());", { compileAndGo : true, noScriptRval : true });

Comment 1

[Christian Holler (:decoder)]

Forgot to clean up the options, --ion-eager --fuzzing-safe is sufficient.

Comment 2

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/9c18da81043e
user:        Hannes Verschore
date:        Thu Feb 13 23:19:15 2014 +0100
summary:     Bug 953164 - IonMonkey: Improve type information at branches, r=jandem

This iteration took 165.820 seconds to run.

Comment 4

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 5

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 448f2153d6d3).

Comment 6

[Christian Holler (:decoder)]

JSBugMon: Fix Bisection requested, result:
=== Tinderbox Build Bisection Results by autoBisect ===

The "bad" changeset has the timestamp "20140522082217" and the hash "80bbd2f2526b".
The "good" changeset has the timestamp "20140522083817" and the hash "4b9f69a50b16".

Likely fix window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=80bbd2f2526b&tochange=4b9f69a50b16