IonMonkey: Assertion failure: false (unexpected constant type), at ion/shared/Lowering-shared.cpp:33

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
major
RESOLVED FIXED
5 years ago
4 years ago

People

(Reporter: decoder, Assigned: nbp)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Other Branch
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update][ion:p1:fx18])

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
The following testcase asserts on ionmonkey revision 2169bca0c9a5 (run with --ion -n -m --ion-eager -a):


var SECTION = "lexical-015";
(function() {
    for (var a = 0; a < 9; a++) {
        if (SECTION[a]) {
            while (arguments[a]) break;
        }
    }
})()
(Reporter)

Comment 1

5 years ago
Please also run this test in an optimized build. You'll notice that it just aborts (you'll get "Aborted" but nothing else). I don't think this is the right behavior, even if opt builds are supposed to be stopped at that point.
(Assignee)

Comment 2

5 years ago
This is likely the MPhi issue with OSR block found by Marty yesterday.
Assignee: general → nicolas.b.pierron
Status: NEW → ASSIGNED
(Assignee)

Updated

5 years ago
Duplicate of this bug: 779691
Whiteboard: [jsbugmon:update] → [jsbugmon:update][ion:p1:fx18]
(Assignee)

Comment 4

5 years ago
Created attachment 648616 [details] [diff] [review]
Substitute MPhi of Magic type by the lazy argument constant.
Attachment #648616 - Flags: review?(dvander)
Attachment #648616 - Flags: review?(dvander) → review+
(Assignee)

Comment 5

5 years ago
Comment on attachment 648616 [details] [diff] [review]
Substitute MPhi of Magic type by the lazy argument constant.

https://hg.mozilla.org/projects/ionmonkey/rev/15db586f9a12
Attachment #648616 - Flags: checkin+
(Reporter)

Updated

5 years ago
Whiteboard: [jsbugmon:update][ion:p1:fx18] → [ion:p1:fx18] [jsbugmon:update,ignore]
(Reporter)

Comment 6

5 years ago
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 15db586f9a12).
(Assignee)

Updated

5 years ago
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Whiteboard: [ion:p1:fx18] [jsbugmon:update,ignore] → [jsbugmon:update][ion:p1:fx18]
(Reporter)

Comment 7

4 years ago
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/2e891e0db397
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.