Closed
Bug 677867
Opened 14 years ago
Closed 14 years ago
IonMonkey: Assertion failure: lhs->type() == rhs->type(), at Lowering.cpp:203
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: adrake, Assigned: rpearl)
References
Details
Attachments
(2 files)
|
221 bytes,
application/javascript
|
Details | |
|
1.39 KB,
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
Attached test case asserts on ionmonkey tip, x86 debug build. Turning off gvn or licm prevents this problem from manifesting, and changing the testcase slightly results in the (seemingly) related assertion:
Assertion failure: lhs->type() == MIRType_Int32, at Lowering.cpp:206
This assert doesn't happen with --ion-gvn=off and it looks like it might be related. All adds are well-typed leaving type analysis and not well typed leaving GVN.
|
Assignee | |
Comment 2•14 years ago
|
||
The issue is that if we create an unbox of some value, producing a double, and an unbox of the same value to, say, an int32, GVN will mark them as congruent, when they shouldn't be.
The proposed patch takes types into account when performing congruence checking.
|
||
Updated•14 years ago
|
Attachment #552219 -
Flags: review?(dvander) → review+
|
|
Assignee | |
Comment 3•14 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•