Closed Bug 755832 Opened 12 years ago Closed 12 years ago

IonMonkey: Assertion failure: [infer failure] Missing type pushed 0: <0x102503060>

Categories

(Core :: JavaScript Engine, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: jruderman, Assigned: jandem)

References

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

./js --ion-eager

var x;
function f(o) {
    o.prop = x = 3;
}
f({});
try { f(1); } catch (e) {}

Assertion failure: [infer failure] Missing type pushed 0: <0x102503060>, at js/src/jsinfer.cpp:353
Attached patch PatchSplinter Review
Small bug: the resumepoint after a setgname did not include the value (on top of the stack). The patch moves the resumeAfter call after pushing the value so that the value is still on the stack for the SETPROP in the testcase.
Assignee: general → jdemooij
Status: NEW → ASSIGNED
Attachment #625036 - Flags: review?(dvander)
To be more precise, the resumepoint was created before popping the global object and pushing the value, so it includes the global object instead of the value (hence the inference failure, <0x102503060> is a global object).
Comment on attachment 625036 [details] [diff] [review]
Patch

Review of attachment 625036 [details] [diff] [review]:
-----------------------------------------------------------------

Yikes. Good find. I think this was the first function to use resume points.
Attachment #625036 - Flags: review?(dvander) → review+
https://hg.mozilla.org/projects/ionmonkey/rev/47b283284868
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug755832.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.