The default bug view has changed. See this FAQ.

IonMonkey: Assertion failure: types.ival == types.rval, at ion/IonBuilder.cpp:2626

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
major
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Assigned: jandem)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Other Branch
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Created attachment 633468 [details]
Testcase for shell

The attached testcase asserts on ionmonkey-arm (private branch) revision 153a2db06024 (run with --ion -n -m --ion-eager).
(Reporter)

Updated

5 years ago
Attachment #633468 - Attachment mime type: text/plain → application/x-gzip
(Assignee)

Comment 1

5 years ago
Also asserts on x86. Pretty sure the assert is just bogus. We have a JSOP_POS with input int32 and output double, I didn't know that was possible but there are probably some edge cases where we remember the output type. Investigating.
Assignee: general → jdemooij
Status: NEW → ASSIGNED
OS: Linux → All
Hardware: ARM → All
(Assignee)

Comment 2

5 years ago
Created attachment 633803 [details] [diff] [review]
Patch

When we GC, TI remembers the type of values monitored in the interpreter (double here). In this case we can have a JSOP_POS with types int32 -> double. I verified that we get the same types with JM+TI.

So the assert is indeed bogus, the patch just relaxes it a bit.
Attachment #633803 - Flags: review?(dvander)
Attachment #633803 - Flags: review?(dvander) → review+
(Assignee)

Comment 3

5 years ago
https://hg.mozilla.org/projects/ionmonkey/rev/de228c331972
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.