769324 - IonMonkey: Assertion failure: [infer failure] Missing type pushed 0: float, at jsinfer.cpp:327

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on ionmonkey revision 4f57f42dc238 (run with --ion -n -m --ion-eager):


function TestCase(n, d, e, a) {}
var SECTION = "11.7.2";
for ( power = 0; power <= 32; power++ ) {
  shiftexp = Math.pow( 2, power );
  for ( addexp = 0; addexp <= 32; addexp++ ) {
    new TestCase( SECTION,
		  SignedRightShift( shiftexp, addexp ),
		  shiftexp >> addexp );
  }
}
function Mask( b, n ) {
  b = ToUint32BitString( b );
  b = ToUint32Decimal( b );
}
function ToUint32BitString( n ) {
  var b = "";
  return b;
}
function ToUint32Decimal( bin ) {
  var r = 0;
  for ( l = bin.length; l < 32; l++ ) {}
  for ( j = 0; j < 31; j++ ) {
    r += Math.pow( 2, j ) * Number(bin.charAt(31-j));
  }
}
function SignedRightShift( s, a ) {
  a = Mask( a, 5 );
}

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

This was created in a window where the tree was orange. I've just pushed the fix.