IonMonkey: Assertion failure: unexpected type, at Lowering.cpp:538

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
5 years ago

People

(Reporter: jandem, Assigned: dvander)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
jit-tests/tests/jaeger/recompile/undef.js asserts. Here's a reduced testcase without callgname:
--
function local() {
    var x;
    x++;
    return x;
}
local();
--
Asserts when lowering MToInt32(undefined).
(Assignee)

Comment 1

5 years ago
Created attachment 594364 [details] [diff] [review]
fix
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #594364 - Flags: review?(bhackett1024)
Comment on attachment 594364 [details] [diff] [review]
fix

Review of attachment 594364 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/shell/js.cpp
@@ +5461,5 @@
>          || !op.addStringOption('\0', "ion-gvn", "[mode]",
>                                 "Specify Ion global value numbering:\n"
>                                 "  off: disable GVN\n"
> +                               "  pessimistic: (default) use pessimistic GVN\n"
> +                               "  optimistic: use optimistic GVN")

Intended for this patch?
Attachment #594364 - Flags: review?(bhackett1024) → review+
(Assignee)

Comment 3

5 years ago
http://hg.mozilla.org/projects/ionmonkey/rev/55fe4b0baa59
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.