Closed Bug 765180 Opened 12 years ago Closed 12 years ago

IonMonkey: Assertion failure: types.ival == types.rval, at ion/IonBuilder.cpp:2626

Categories

(Core :: JavaScript Engine, defect)

Other Branch
defect
Not set
major

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Assigned: jandem)

References

Details

(Keywords: assertion, testcase)

Attachments

(2 files)

Attached file Testcase for shell
The attached testcase asserts on ionmonkey-arm (private branch) revision 153a2db06024 (run with --ion -n -m --ion-eager).
Attachment #633468 - Attachment mime type: text/plain → application/x-gzip
Also asserts on x86. Pretty sure the assert is just bogus. We have a JSOP_POS with input int32 and output double, I didn't know that was possible but there are probably some edge cases where we remember the output type. Investigating.
Assignee: general → jdemooij
Status: NEW → ASSIGNED
OS: Linux → All
Hardware: ARM → All
Attached patch PatchSplinter Review
When we GC, TI remembers the type of values monitored in the interpreter (double here). In this case we can have a JSOP_POS with types int32 -> double. I verified that we get the same types with JM+TI.

So the assert is indeed bogus, the patch just relaxes it a bit.
Attachment #633803 - Flags: review?(dvander)
Attachment #633803 - Flags: review?(dvander) → review+
https://hg.mozilla.org/projects/ionmonkey/rev/de228c331972
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.