Last Comment Bug 765180 - IonMonkey: Assertion failure: types.ival == types.rval, at ion/IonBuilder.cpp:2626
: IonMonkey: Assertion failure: types.ival == types.rval, at ion/IonBuilder.cpp...
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: All All
-- major (vote)
: ---
Assigned To: Jan de Mooij [:jandem]
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: langfuzz IonFuzz
  Show dependency treegraph
Reported: 2012-06-15 03:43 PDT by Christian Holler (:decoder)
Modified: 2012-06-19 08:55 PDT (History)
6 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Testcase for shell (1.12 KB, application/x-gzip)
2012-06-15 03:43 PDT, Christian Holler (:decoder)
no flags Details
Patch (704 bytes, patch)
2012-06-16 07:12 PDT, Jan de Mooij [:jandem]
dvander: review+
Details | Diff | Splinter Review

Description User image Christian Holler (:decoder) 2012-06-15 03:43:23 PDT
Created attachment 633468 [details]
Testcase for shell

The attached testcase asserts on ionmonkey-arm (private branch) revision 153a2db06024 (run with --ion -n -m --ion-eager).
Comment 1 User image Jan de Mooij [:jandem] 2012-06-15 05:34:49 PDT
Also asserts on x86. Pretty sure the assert is just bogus. We have a JSOP_POS with input int32 and output double, I didn't know that was possible but there are probably some edge cases where we remember the output type. Investigating.
Comment 2 User image Jan de Mooij [:jandem] 2012-06-16 07:12:44 PDT
Created attachment 633803 [details] [diff] [review]

When we GC, TI remembers the type of values monitored in the interpreter (double here). In this case we can have a JSOP_POS with types int32 -> double. I verified that we get the same types with JM+TI.

So the assert is indeed bogus, the patch just relaxes it a bit.
Comment 3 User image Jan de Mooij [:jandem] 2012-06-19 08:55:51 PDT

Note You need to log in before you can comment on or make changes to this bug.