Closed Bug 780842 Opened 9 years ago Closed 9 years ago

IonMonkey: Assertion failure: id == MakeTypeId(cx, id), at ../jsinferinlines.h:1401

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86
Linux
defect
Not set
major

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Unassigned)

References

Details

(Keywords: assertion, testcase, Whiteboard: [ion:p1:fx18] [jsbugmon:update,ignore])

Attachments

(1 file)

The following testcase asserts on ionmonkey revision 15db586f9a12 (run with --ion -n -m --ion-eager -a):


function testUKeyUObject(a, key1, key2, key3) {
    assertEq(a[-1](), "hi");
}
for (var i = 0; i < 5; i++) {
    testUKeyUObject({}, "a", "b", "c");
}
Whiteboard: [jsbugmon:update] → [jsbugmon:update][ion:p1:fx18]
Kannan, this looks like poly inlining fallout. I think we just need an (id == MakeTypeId(id)) check in the loop under IonBuilder::annotateGetPropertyCache?
Yep, but we can do the check up at the beginning instead of in each loop iteration.
Attachment #650777 - Flags: review?(jdemooij)
Attachment #650777 - Flags: review?(jdemooij) → review+
Btw, please also add the test case.
Whiteboard: [jsbugmon:update][ion:p1:fx18] → [ion:p1:fx18] [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 4121663806d0).
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug780842.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.