The default bug view has changed. See this FAQ.

IonMonkey: "Assertion failure: ins->type() == MIRType_Value,"

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
5 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
x86
Linux
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
Created attachment 568238 [details]
stack

o = []
function f() {
    o
}
new f
f()

asserts js debug shell on IM changeset 7a002b39d8be with -m, -n and --ion-eager at Assertion failure: ins->type() == MIRType_Value,
(Reporter)

Comment 1

5 years ago
No longer reproduces, possibly fixed by bug 700211.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   80422:88f65dfb4831
user:        Nicolas Pierron
date:        Thu Nov 10 19:49:37 2011 -0800
summary:     Do not add type barrier if instruction has expected type. (Bug 700211, r=sstangl)
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
(Reporter)

Updated

5 years ago
Blocks: 724444
Summary: IM: "Assertion failure: ins->type() == MIRType_Value," → IonMonkey: "Assertion failure: ins->type() == MIRType_Value,"
You need to log in before you can comment on or make changes to this bug.