Closed
Bug 746397
Opened 12 years ago
Closed 12 years ago
IonMonkey: Assertion failure: unexpected type, at ion/Lowering.cpp:822
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: decoder, Assigned: djvj)
References
Details
(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update,reconfirm,ignore])
Attachments
(1 file, 1 obsolete file)
660 bytes,
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
The following testcase asserts on ionmonkey revision 67bf9a4a1f77 (run with --ion -n -m --ion-eager): (function () { var a = ['x', 'y']; obj.watch(a[+("0")], counter); })();
Reporter | ||
Comment 1•12 years ago
|
||
JSBugMon: The testcase found in this bug no longer reproduces (tried revision de015aff650d).
Reporter | ||
Updated•12 years ago
|
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
Reporter | ||
Comment 2•12 years ago
|
||
The test here broke because bug
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:update,reconfirm]
Reporter | ||
Comment 3•12 years ago
|
||
Yea.. because bug... because bug 724751 removed the --ion, -n and -m options. It probably would have been better to keep them without any action such that automation doesn't break.
Reporter | ||
Comment 4•12 years ago
|
||
JSBugMon: This bug has been automatically confirmed to be still valid (reproduced on revision 9e64f779b611).
Reporter | ||
Updated•12 years ago
|
Whiteboard: [jsbugmon:update,reconfirm] → [jsbugmon:update,reconfirm,ignore]
Assignee | ||
Updated•12 years ago
|
Assignee: general → kvijayan
Assignee | ||
Comment 5•12 years ago
|
||
The issue here is simple: IonBuilder's handling of jsop_pos tries to optimize the case when the input is an int32 by leaving the input as-is. However, when checking for this case, it checks the 'rval' (result value) typeset for the jsop_pos operation instead of the 'ival' (input value) typeset. The rval typeset for jsop_pos is optimistically initialized to INT32. This devolves into a ToInt32 of a string in MIR, which triggers an assert because the LIRGenerator doesn't yet handle compiled String->Int32 conversions.
Attachment #619657 -
Flags: review?(dvander)
Updated•12 years ago
|
Attachment #619657 -
Flags: review?(dvander) → review+
Assignee | ||
Comment 6•12 years ago
|
||
The previous diff was barebones. This is the same patch, but with more patch context and function names present.
Attachment #619657 -
Attachment is obsolete: true
Attachment #619659 -
Flags: review?(dvander)
Updated•12 years ago
|
Attachment #619659 -
Flags: review?(dvander) → review+
Assignee | ||
Comment 7•12 years ago
|
||
http://hg.mozilla.org/projects/ionmonkey/rev/ff4083f660ed
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Reporter | ||
Comment 8•11 years ago
|
||
Automatically extracted testcase for this bug was committed: https://hg.mozilla.org/mozilla-central/rev/2e891e0db397
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•