836774 - IonMonkey: Assertion failure: !"unexpected type", at ion/Lowering.cpp:1224

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 20bbf73921f4 (run with --ion-eager):


x = ''.charCodeAt(NaN);
evaluate("for each (var e in [{}, {}, {}, {}, x]) {}");

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   120310:d7dd65663469
user:        Brian Hackett
date:        Tue Jan 29 16:20:03 2013 -0700
summary:     Bug 833898 - Allow converting mixed arrays of ints and doubles to uniform doubles, r=jandem.

This iteration took 0.524 seconds to run.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Brian, do you think bug 833898 is a likely regressor?

Comment 3

[Brian Hackett [Laid off!]]

Attachment: patch

MToDouble isn't robust enough to cope with object or string inputs.  This patch boxes them into arbitrary values, which are handled by ToDouble.

Comment 4

[Jan de Mooij [:jandem]]

Comment on attachment 708687 [details] [diff] [review]
patch

Review of attachment 708687 [details] [diff] [review]:
-----------------------------------------------------------------

Type analysis may insert ToDouble instructions as well, not sure if it calls adjustInputs on them. Here you insert MToDouble during IonBuilder so this is fine.

Can you grep for "JS_ASSERT(!" in Lowering.cpp and change these to JS_NOT_REACHED? r=me with that.

Comment 5

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/6123591fafb8

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/6123591fafb8