Last Comment Bug 725061 - IonMonkey: Assertion failure: opd->type() == phi->type(), at ion/Lowering.cpp:1302
: IonMonkey: Assertion failure: opd->type() == phi->type(), at ion/Lowering.cpp...
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Linux
: -- major (vote)
: ---
Assigned To: David Anderson [:dvander]
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: langfuzz IonFuzz
  Show dependency treegraph
 
Reported: 2012-02-07 13:00 PST by Christian Holler (:decoder)
Modified: 2013-01-14 07:50 PST (History)
5 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
fix (2.10 KB, patch)
2012-02-08 18:39 PST, David Anderson [:dvander]
jdemooij: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2012-02-07 13:00:44 PST
The following testcase asserts on ionmonkey revision c34398f961e7 (run with --ion -n -m), tested on 64 bit:


function testInt(n, result) {
    var x = 0;
    for (var i = 0; i < 15; i++) {
        if (x % 2 == 0)
            x = 10;
        else
            x %=  0;
    }
    for (var i = 0; i < 15; i++) {    }
}
testInt(2147483647, 2147483647);
testInt(-2147483648, -2147483648);
Comment 1 David Anderson [:dvander] 2012-02-08 18:39:24 PST
Created attachment 595608 [details] [diff] [review]
fix

Don't fold MMod when doing so could change its result type.
Comment 2 David Anderson [:dvander] 2012-02-09 12:07:36 PST
http://hg.mozilla.org/projects/ionmonkey/rev/fa22733dd172
Comment 3 Christian Holler (:decoder) 2013-01-14 07:50:17 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug725061.js.

Note You need to log in before you can comment on or make changes to this bug.