Closed Bug 779818 Opened 12 years ago Closed 12 years ago

IonMonkey: Assertion failure: false (unexpected constant type), at ion/shared/Lowering-shared.cpp:33

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86_64
Linux
defect
Not set
major

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Assigned: nbp)

References

Details

(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update][ion:p1:fx18])

Attachments

(1 file)

The following testcase asserts on ionmonkey revision 2169bca0c9a5 (run with --ion -n -m --ion-eager -a):


var SECTION = "lexical-015";
(function() {
    for (var a = 0; a < 9; a++) {
        if (SECTION[a]) {
            while (arguments[a]) break;
        }
    }
})()
Please also run this test in an optimized build. You'll notice that it just aborts (you'll get "Aborted" but nothing else). I don't think this is the right behavior, even if opt builds are supposed to be stopped at that point.
This is likely the MPhi issue with OSR block found by Marty yesterday.
Assignee: general → nicolas.b.pierron
Status: NEW → ASSIGNED
Whiteboard: [jsbugmon:update] → [jsbugmon:update][ion:p1:fx18]
Attachment #648616 - Flags: review?(dvander) → review+
Comment on attachment 648616 [details] [diff] [review]
Substitute MPhi of Magic type by the lazy argument constant.

https://hg.mozilla.org/projects/ionmonkey/rev/15db586f9a12
Attachment #648616 - Flags: checkin+
Whiteboard: [jsbugmon:update][ion:p1:fx18] → [ion:p1:fx18] [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 15db586f9a12).
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Whiteboard: [ion:p1:fx18] [jsbugmon:update,ignore] → [jsbugmon:update][ion:p1:fx18]
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/2e891e0db397
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.