746397 - IonMonkey: Assertion failure: unexpected type, at ion/Lowering.cpp:822

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on ionmonkey revision 67bf9a4a1f77 (run with --ion -n -m --ion-eager):


(function () {
  var a = ['x', 'y'];
  obj.watch(a[+("0")], counter);
})();

Comment 1

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision de015aff650d).

Comment 2

[Christian Holler (:decoder)]

The test here broke because bug

Comment 3

[Christian Holler (:decoder)]

Yea.. because bug...  because bug 724751 removed the --ion, -n and -m options. It probably would have been better to keep them without any action such that automation doesn't break.

Comment 4

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically confirmed to be still valid (reproduced on revision 9e64f779b611).

Comment 5

[Kannan Vijayan [:djvj]]

Attachment: Fix

The issue here is simple: IonBuilder's handling of jsop_pos tries to optimize the case when the input is an int32 by leaving the input as-is.

However, when checking for this case, it checks the 'rval' (result value) typeset for the jsop_pos operation instead of the 'ival' (input value) typeset.  The rval typeset for jsop_pos is optimistically initialized to INT32.  This devolves into a ToInt32 of a string in MIR, which triggers an assert because the LIRGenerator doesn't yet handle compiled String->Int32 conversions.

Comment 6

[Kannan Vijayan [:djvj]]

Attachment: FIX: Better diff with more context

The previous diff was barebones.  This is the same patch, but with more patch context and function names present.

Comment 7

[Kannan Vijayan [:djvj]]

http://hg.mozilla.org/projects/ionmonkey/rev/ff4083f660ed

Comment 8

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/2e891e0db397