999622 - Assertion failure: !input()->mightBeType(MIRType_Object), at jit/MIR.h:3108

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision c962bde5ac0b (run with --fuzzing-safe --ion-eager):


function foo() {
  x = new Boolean(true);
  try {
    for (var e = 0; e != 5; ++e) {
      var x = x.name;
    }
    for (var e = 0; e != e.length; ++e) {
      for (var x = 1; x != e.length; ++x) {}
    }
  }  catch(x)  {}
  return '' + x;
} foo();

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unknown exception (check manually)

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
=== Tinderbox Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20140328112633" and the hash "e44d921f23dc".
The "bad" changeset has the timestamp "20140328114932" and the hash "f65515f94aab".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=e44d921f23dc&tochange=f65515f94aab

Comment 4

[Christian Holler (:decoder)]

That bisection doesn't seem to make much sense...

Comment 5

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/797a3c64b400
parent:      166181:2a7a697f2d88
user:        Hannes Verschore
date:        Fri Jan 31 10:24:02 2014 +0100
summary:     Bug 964229 - IonMonkey: Split StringPolicy and support all primitives to MToString, r=jandem,sstangl

This iteration took 1.540 seconds to run.

Comment 6

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 76432b693fc4).

Comment 7

[Christian Holler (:decoder)]

JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/e56e4ae99177
parent:      185661:9164a6ab85b2
user:        Hannes Verschore
date:        Tue May 27 15:18:51 2014 -0700
summary:     Bug 1015205 - Part 1: Let MToString work on all types (bails for MIRType_Object) r=bbouvier

This iteration took 2.364 seconds to run.

Comment 8

[Benjamin Bouvier [:bbouvier] (inactive)]

Fixed by bug 1015205.