Created attachment 633468 [details] Testcase for shell The attached testcase asserts on ionmonkey-arm (private branch) revision 153a2db06024 (run with --ion -n -m --ion-eager).
Also asserts on x86. Pretty sure the assert is just bogus. We have a JSOP_POS with input int32 and output double, I didn't know that was possible but there are probably some edge cases where we remember the output type. Investigating.
Created attachment 633803 [details] [diff] [review] Patch When we GC, TI remembers the type of values monitored in the interpreter (double here). In this case we can have a JSOP_POS with types int32 -> double. I verified that we get the same types with JM+TI. So the assert is indeed bogus, the patch just relaxes it a bit.