IonMonkey: Assertion failure: false (unexpected constant type), at ion/shared/Lowering-shared.cpp:33

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
major
RESOLVED FIXED
5 years ago
4 years ago

People

(Reporter: decoder, Assigned: nbp)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Other Branch
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update][ion:p1:fx18])

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
The following testcase asserts on ionmonkey revision 2169bca0c9a5 (run with --ion -n -m --ion-eager -a):


var SECTION = "lexical-015";
(function() {
    for (var a = 0; a < 9; a++) {
        if (SECTION[a]) {
            while (arguments[a]) break;
        }
    }
})()
(Reporter)

Comment 1

5 years ago
Please also run this test in an optimized build. You'll notice that it just aborts (you'll get "Aborted" but nothing else). I don't think this is the right behavior, even if opt builds are supposed to be stopped at that point.
This is likely the MPhi issue with OSR block found by Marty yesterday.
Assignee: general → nicolas.b.pierron
Status: NEW → ASSIGNED
Duplicate of this bug: 779691
Whiteboard: [jsbugmon:update] → [jsbugmon:update][ion:p1:fx18]
Created attachment 648616 [details] [diff] [review]
Substitute MPhi of Magic type by the lazy argument constant.
Attachment #648616 - Flags: review?(dvander)
Attachment #648616 - Flags: review?(dvander) → review+
Comment on attachment 648616 [details] [diff] [review]
Substitute MPhi of Magic type by the lazy argument constant.

https://hg.mozilla.org/projects/ionmonkey/rev/15db586f9a12
Attachment #648616 - Flags: checkin+
(Reporter)

Updated

5 years ago
Whiteboard: [jsbugmon:update][ion:p1:fx18] → [ion:p1:fx18] [jsbugmon:update,ignore]
(Reporter)

Comment 6

5 years ago
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 15db586f9a12).
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Whiteboard: [ion:p1:fx18] [jsbugmon:update,ignore] → [jsbugmon:update][ion:p1:fx18]
(Reporter)

Comment 7

4 years ago
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/2e891e0db397
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.