IonMonkey: Assertion failure: ins->type() == MIRType_Value, during pushTypeBarrier().

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: sstangl, Assigned: nbp)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

6 years ago
Created attachment 572378 [details]
Test case: JSOP_GETGNAME with TI.

This error is tripping frequently in the OSR branch, but can be reproduced on master with the attached test case. The IonBuilder is attempting to create an MUnbox instruction to act on MLoadSlots, which is Type_Int32.

Test case must be run with "--ion -n" to reproduce.
Assignee: general → nicolas.b.pierron
Created attachment 572861 [details] [diff] [review]
Check load instruction type.
Attachment #572861 - Flags: review?(sstangl)
(Reporter)

Updated

6 years ago
Attachment #572861 - Flags: review?(sstangl) → review+
(Reporter)

Comment 2

6 years ago
http://hg.mozilla.org/projects/ionmonkey/rev/88f65dfb4831
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.