Last Comment Bug 695902 - IonMonkey: "Assertion failure: ins->type() == MIRType_Value,"
: IonMonkey: "Assertion failure: ins->type() == MIRType_Value,"
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Linux
: -- critical (vote)
: ---
Assigned To: general
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: IonFuzz 630996
  Show dependency treegraph
 
Reported: 2011-10-19 16:04 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2012-02-05 22:57 PST (History)
4 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
stack (4.31 KB, text/plain)
2011-10-19 16:04 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details

Description Gary Kwong [:gkw] [:nth10sd] 2011-10-19 16:04:57 PDT
Created attachment 568238 [details]
stack

o = []
function f() {
    o
}
new f
f()

asserts js debug shell on IM changeset 7a002b39d8be with -m, -n and --ion-eager at Assertion failure: ins->type() == MIRType_Value,
Comment 1 Gary Kwong [:gkw] [:nth10sd] 2011-11-28 16:06:49 PST
No longer reproduces, possibly fixed by bug 700211.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   80422:88f65dfb4831
user:        Nicolas Pierron
date:        Thu Nov 10 19:49:37 2011 -0800
summary:     Do not add type barrier if instruction has expected type. (Bug 700211, r=sstangl)

Note You need to log in before you can comment on or make changes to this bug.