Created attachment 500006 [details] [diff] [review] Fix Type inference assigns a double type to the stack slots for the ITER/FOR* opcodes and sets ignoreTypeTag to true. moreIter then calls fixDoubleTypes, which ignores this flag, and assigns a double tag to the iterator object. moreIter then calls tempRegForData and this asserts because it does not expect a double. This patch adds a check for ignoreTypeTag to fixDoubleTypes. I had to rewrite the loop to be more like the one in restoreAnalysisTypes, so I could access the ignoreTypeTag flag.
This will I think be unnecessary after the patch for bug 621301 lands tonight (will double check). That changes things so that types are restored/fixed only for locals and args at basic block boundaries, mirroring the regalloc. ignoreTypeTag is gone (along with TypeStack), but the horrible iteration hack is still there and can probably bite in other ways --- should find a cleaner fix.
This testcase works now. http://hg.mozilla.org/projects/jaegermonkey/rev/fbeecf1d1f4c
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug621655.js.