729788 - IonMonkey: Assertion failure: ins->num()->type() == MIRType_Double, at ion/Lowering.cpp:486

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on ionmonkey revision 5a04fd69aa09 (run with --ion -n -m), tested on 64 bit:


var msPerDay = 86400000;
function Day(t) {
    return Math.floor(t / msPerDay);
}
function YearFromTime(t) {
    sign = 1
    year = sign < 0
}
function MonthFromTime(t) {
    DayWithinYear(t)
    function DayWithinYear(t) Day(t) - YearFromTime()
    function WeekDay(t) {
        weekday = Day(t) + 4
        return (weekday < 0 ? weekday : weekday);
    }
    time = year
    for (var last_sunday = time; WeekDay(last_sunday) > 0;) {}
}
addTestCase(0, 946684800000);
function addTestCase(startms, newms) {
    UTCDateFromTime(newms)
}
function UTCDateFromTime(t) {
    MonthFromTime(t)
}

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Simple bug - even if TI tells us the input will definitely be double, we don't guarantee IR nodes of the narrowest type. So just introduce a DoublePolicy.

Comment 2

[Nicolas B. Pierron [:nbp] {away}]

Comment on attachment 599863 [details] [diff] [review]
fix

Review of attachment 599863 [details] [diff] [review]:
-----------------------------------------------------------------

Looks Good, potentially reducing the test case to a minimal one.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/projects/ionmonkey/rev/89ec3e375d60

Comment 4

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug729788.js.