Closed
Bug 845023
Opened 12 years ago
Closed 12 years ago
BaselineCompiler: Crash [@ poppedTypes] or [@ js::ion::TypeInferenceOracle::binaryTypes] or [@ js::ion::IonBuilder::traverseBytecode] or "Assertion failure: array,"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Unassigned)
References
(Blocks 1 open bug)
Details
(4 keywords, Whiteboard: [fuzzblocker] [jsbugmon:])
Crash Data
Attachments
(2 files)
|
(deleted),
text/plain
|
Details | |
|
(deleted),
patch
|
bhackett1024
:
review+
|
Details | Diff | Splinter Review |
for (var x = 1; x < 99; x++) {}
asserts js debug shell on ionmonkey changeset 1f1f815eb9e8 with --no-baseline --no-jm at Assertion failure: array, and crashes js opt shell at various signatures, e.g. [@ poppedTypes] or [@ js::ion::TypeInferenceOracle::binaryTypes] or [@ js::ion::IonBuilder::traverseBytecode]
Setting fuzzblocker because this simple testcase is causing issues throughout the fuzzer.
|
Reporter | |
Comment 1•12 years ago
|
||
I checked and this does not seem to affect m-c changeset 06935f2db267.
|
||
Updated•12 years ago
|
Crash Signature: [@ poppedTypes]
[@ js::ion::TypeInferenceOracle::binaryTypes]
[@ js::ion::IonBuilder::traverseBytecode] → [@ poppedTypes]
[@ js::ion::TypeInferenceOracle::binaryTypes]
[@ js::ion::IonBuilder::traverseBytecode]
Whiteboard: [fuzzblocker][jsbugmon:update] → [fuzzblocker] [jsbugmon:]
|
|
||
Comment 2•12 years ago
|
||
JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.
|
||
Comment 3•12 years ago
|
||
Attachment #718067 -
Flags: review?(bhackett1024)
|
||
Updated•12 years ago
|
Attachment #718067 -
Flags: review?(bhackett1024) → review+
|
|
||
Comment 4•12 years ago
|
||
Crash Signature: [@ poppedTypes]
[@ js::ion::TypeInferenceOracle::binaryTypes]
[@ js::ion::IonBuilder::traverseBytecode] → [@ poppedTypes]
[@ js::ion::TypeInferenceOracle::binaryTypes]
[@ js::ion::IonBuilder::traverseBytecode]
|
|
Reporter | |
Comment 5•12 years ago
|
||
I'm guessing bug 844246 is the regressor based on the last modified changeset inspection via:
https://hg.mozilla.org/projects/ionmonkey/annotate/1f1f815eb9e8/js/src/ion/TypeOracle.cpp#l42
Blocks: 844246
|
|
Reporter | |
Comment 6•12 years ago
|
||
This is now fixed.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•