Last Comment Bug 700211 - IonMonkey: Assertion failure: ins->type() == MIRType_Value, during pushTypeBarrier().
: IonMonkey: Assertion failure: ins->type() == MIRType_Value, during pushTypeBa...
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: x86_64 Linux
: -- normal (vote)
: ---
Assigned To: Nicolas B. Pierron [:nbp]
:
Mentors:
Depends on:
Blocks: 700108
  Show dependency treegraph
 
Reported: 2011-11-06 19:40 PST by Sean Stangl [:sstangl]
Modified: 2011-11-10 19:53 PST (History)
1 user (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Test case: JSOP_GETGNAME with TI. (209 bytes, application/javascript)
2011-11-06 19:40 PST, Sean Stangl [:sstangl]
no flags Details
Check load instruction type. (1.77 KB, patch)
2011-11-08 09:51 PST, Nicolas B. Pierron [:nbp]
sstangl: review+
Details | Diff | Review

Description Sean Stangl [:sstangl] 2011-11-06 19:40:21 PST
Created attachment 572378 [details]
Test case: JSOP_GETGNAME with TI.

This error is tripping frequently in the OSR branch, but can be reproduced on master with the attached test case. The IonBuilder is attempting to create an MUnbox instruction to act on MLoadSlots, which is Type_Int32.

Test case must be run with "--ion -n" to reproduce.
Comment 1 Nicolas B. Pierron [:nbp] 2011-11-08 09:51:41 PST
Created attachment 572861 [details] [diff] [review]
Check load instruction type.
Comment 2 Sean Stangl [:sstangl] 2011-11-10 19:53:06 PST
http://hg.mozilla.org/projects/ionmonkey/rev/88f65dfb4831

Note You need to log in before you can comment on or make changes to this bug.