IonMonkey: Assertion failure: unexpected type, at ion/Lowering.cpp:626

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: jandem, Assigned: jandem)

Tracking

(Blocks: 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

6 years ago
Another assert found while reducing a modified SS fannkuch.

Blocking bug 724444 to avoid duplicates.
(Assignee)

Comment 1

6 years ago
Created attachment 594695 [details] [diff] [review]
Patch

If a binary op has int32 result type but one of its operands is |undefined|, we don't want to specialize as int32 since ToNumber(undefined) is NaN. The result will likely be a double (NaN) anyway so just let the stub trigger invalidation.

The alternative is to accept only int32 or double types, but I'd rather not do that: (poorly written) benchmarks/scripts may use int32 + bool or something and ToInt32 can handle that just fine.
Attachment #594695 - Flags: review?(dvander)
Attachment #594695 - Flags: review?(dvander) → review+
(Assignee)

Comment 2

6 years ago
http://hg.mozilla.org/projects/ionmonkey/rev/e79f7bc9d725
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.