737299 - IonMonkey: Assertion failure: opd->type() == phi->type(), at ion/Lowering.cpp:1549

Status: RESOLVED DUPLICATE of bug 747271

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on ionmonkey revision b5b6e6aebb36 (run with --ion -n -m --ion-eager):


function TestCase(n, d, e, a) {}
var SECTION = "11.10-1";
var shiftexp = 0;
var addexp = 0;
  for ( addpow = 0; addpow < 33; addpow++ ) {
    addexp += Math.pow(2, addpow);
    new TestCase( SECTION, And( shiftexp, addexp ), shiftexp & addexp );
}
function ToInt32BitString( n ) {
  var sign = ( n < 0 ) ? -1 : 1;
  for ( p = 30; p >=0; p-- ) {
    if ( (sign == 1 ) ? sign * n >= Math.pow(2,p) : sign * n > Math.pow(2,p) ) {
      n = sign * Math.pow( 2, p );
    }
  }
}
function And( s, a ) {
  var ba = ToInt32BitString( a );
}

Comment 1

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision c45668383f51).