Closed Bug 695902 Opened 12 years ago Closed 12 years ago

IonMonkey: "Assertion failure: ins->type() == MIRType_Value,"

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

stack
4.31 KB, text/plain
Details
Attached file stack — 
o = []
function f() {
    o
}
new f
f()

asserts js debug shell on IM changeset 7a002b39d8be with -m, -n and --ion-eager at Assertion failure: ins->type() == MIRType_Value,
No longer reproduces, possibly fixed by bug 700211.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   80422:88f65dfb4831
user:        Nicolas Pierron
date:        Thu Nov 10 19:49:37 2011 -0800
summary:     Do not add type barrier if instruction has expected type. (Bug 700211, r=sstangl)
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Blocks: IonFuzz
Summary: IM: "Assertion failure: ins->type() == MIRType_Value," → IonMonkey: "Assertion failure: ins->type() == MIRType_Value,"
You need to log in before you can comment on or make changes to this bug.