Closed Bug 621655 Opened 9 years ago Closed 9 years ago
Inference: JM: "Assertion failure: !fe->is Type(JSVAL _TYPE _DOUBLE)"
Type inference assigns a double type to the stack slots for the ITER/FOR* opcodes and sets ignoreTypeTag to true. moreIter then calls fixDoubleTypes, which ignores this flag, and assigns a double tag to the iterator object. moreIter then calls tempRegForData and this asserts because it does not expect a double. This patch adds a check for ignoreTypeTag to fixDoubleTypes. I had to rewrite the loop to be more like the one in restoreAnalysisTypes, so I could access the ignoreTypeTag flag.
Assignee: general → jandemooij
Status: NEW → ASSIGNED
This will I think be unnecessary after the patch for bug 621301 lands tonight (will double check). That changes things so that types are restored/fixed only for locals and args at basic block boundaries, mirroring the regalloc. ignoreTypeTag is gone (along with TypeStack), but the horrible iteration hack is still there and can probably bite in other ways --- should find a cleaner fix.
OS: Mac OS X → Windows 7
This testcase works now. http://hg.mozilla.org/projects/jaegermonkey/rev/fbeecf1d1f4c
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug621655.js.
You need to log in before you can comment on or make changes to this bug.