1643669 - Warp: Assertion failure: def->type() == MIRType::Int32 || def->type() == MIRType::Double in MTypedArrayIndexToInt32

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect, P3)

Description

[André Bargull [:anba]]

Run with --ion-offthread-compile=off --warp:

function f(ta, i) {
    return ta[i];
}

var ta = new Int32Array(10);
var xs = [0, 1, 2, -1];

for (var i = 0; i < 100_000; ++i) {
    f(ta, xs[i&3]);
}

Asserts with:

Assertion failure: def->type() == MIRType::Int32 || def->type() == MIRType::Double, at /home/andre/git/mozilla-central/js/src/jit/MIR.h:7332

Comment 1

[Jan de Mooij [:jandem]]

Is this just a bogus assert for Warp?

Comment 2

[Tom S. (please needinfo tschuster)]

I think so. MTypedArrayIndexToInt32 has a type policy for unboxing int32/double so it should be fine.

Comment 4

[Tom S. (please needinfo tschuster)]

Attachment: Bug 1643669 - Correct input type for MTypedArrayIndexToInt32 in Warp. r?jandem!

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6fbdf96ceeb6
Correct input type for MTypedArrayIndexToInt32 in Warp. r=jandem

Comment 6

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/6fbdf96ceeb6