Closed Bug 724530 Opened 12 years ago Closed 12 years ago

IonMonkey: Assertion failure: unexpected type, at ion/Lowering.cpp:626

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Assigned: jandem)

References

Details

Attachments

(1 file)

Another assert found while reducing a modified SS fannkuch.

Blocking bug 724444 to avoid duplicates.
Attached patch PatchSplinter Review
If a binary op has int32 result type but one of its operands is |undefined|, we don't want to specialize as int32 since ToNumber(undefined) is NaN. The result will likely be a double (NaN) anyway so just let the stub trigger invalidation.

The alternative is to accept only int32 or double types, but I'd rather not do that: (poorly written) benchmarks/scripts may use int32 + bool or something and ToInt32 can handle that just fine.
Attachment #594695 - Flags: review?(dvander)
Attachment #594695 - Flags: review?(dvander) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/e79f7bc9d725
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.