Closed Bug 729788 Opened 12 years ago Closed 12 years ago

IonMonkey: Assertion failure: ins->num()->type() == MIRType_Double, at ion/Lowering.cpp:486

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86_64
Linux
defect
Not set
major

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Assigned: dvander)

References

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

The following testcase asserts on ionmonkey revision 5a04fd69aa09 (run with --ion -n -m), tested on 64 bit:


var msPerDay = 86400000;
function Day(t) {
    return Math.floor(t / msPerDay);
}
function YearFromTime(t) {
    sign = 1
    year = sign < 0
}
function MonthFromTime(t) {
    DayWithinYear(t)
    function DayWithinYear(t) Day(t) - YearFromTime()
    function WeekDay(t) {
        weekday = Day(t) + 4
        return (weekday < 0 ? weekday : weekday);
    }
    time = year
    for (var last_sunday = time; WeekDay(last_sunday) > 0;) {}
}
addTestCase(0, 946684800000);
function addTestCase(startms, newms) {
    UTCDateFromTime(newms)
}
function UTCDateFromTime(t) {
    MonthFromTime(t)
}
Attached patch fixSplinter Review
Simple bug - even if TI tells us the input will definitely be double, we don't guarantee IR nodes of the narrowest type. So just introduce a DoublePolicy.
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #599863 - Flags: review?(nicolas.b.pierron)
Comment on attachment 599863 [details] [diff] [review]
fix

Review of attachment 599863 [details] [diff] [review]:
-----------------------------------------------------------------

Looks Good, potentially reducing the test case to a minimal one.
Attachment #599863 - Flags: review?(nicolas.b.pierron) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/89ec3e375d60
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug729788.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.