692213 - IM: Assertion failure: Bad SSA value, at ../jsanalyze.h:1089

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on ionmonkey revision acf3c1fb7c94 (run with --ion -n), tested on 64 bit:


function X(n) {
    while ('' + (n--)) {
        switch ( X( "w", "w*abc" ) ) { default : }   
    }
}
(X)();

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Comment 2

[Brian Hackett [Laid off!]]

Comment on attachment 566393 [details] [diff] [review]
fix

This is fine so long as the binaryOp inputs are best guesses and will be type checked later during compilation (which as I recall is the case).  Otherwise, due to coercion from a non-number value there could be a type mismatch between the input and output.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

https://hg.mozilla.org/projects/ionmonkey/rev/3486d7214539

Comment 4

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug692213.js.