Last Comment Bug 700211 - IonMonkey: Assertion failure: ins->type() == MIRType_Value, during pushTypeBarrier().
: IonMonkey: Assertion failure: ins->type() == MIRType_Value, during pushTypeBa...
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: x86_64 Linux
-- normal (vote)
: ---
Assigned To: Nicolas B. Pierron [:nbp]
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: 700108
  Show dependency treegraph
Reported: 2011-11-06 19:40 PST by Sean Stangl [:sstangl]
Modified: 2011-11-10 19:53 PST (History)
1 user (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Test case: JSOP_GETGNAME with TI. (209 bytes, application/javascript)
2011-11-06 19:40 PST, Sean Stangl [:sstangl]
no flags Details
Check load instruction type. (1.77 KB, patch)
2011-11-08 09:51 PST, Nicolas B. Pierron [:nbp]
sstangl: review+
Details | Diff | Splinter Review

Description User image Sean Stangl [:sstangl] 2011-11-06 19:40:21 PST
Created attachment 572378 [details]
Test case: JSOP_GETGNAME with TI.

This error is tripping frequently in the OSR branch, but can be reproduced on master with the attached test case. The IonBuilder is attempting to create an MUnbox instruction to act on MLoadSlots, which is Type_Int32.

Test case must be run with "--ion -n" to reproduce.
Comment 1 User image Nicolas B. Pierron [:nbp] 2011-11-08 09:51:41 PST
Created attachment 572861 [details] [diff] [review]
Check load instruction type.
Comment 2 User image Sean Stangl [:sstangl] 2011-11-10 19:53:06 PST

Note You need to log in before you can comment on or make changes to this bug.