Closed Bug 700211 Opened 13 years ago Closed 13 years ago

IonMonkey: Assertion failure: ins->type() == MIRType_Value, during pushTypeBarrier().

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: sstangl, Assigned: nbp)

References

Details

Attachments

(2 files)

This error is tripping frequently in the OSR branch, but can be reproduced on master with the attached test case. The IonBuilder is attempting to create an MUnbox instruction to act on MLoadSlots, which is Type_Int32.

Test case must be run with "--ion -n" to reproduce.
Assignee: general → nicolas.b.pierron
Attachment #572861 - Flags: review?(sstangl)
Attachment #572861 - Flags: review?(sstangl) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/88f65dfb4831
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.