Closed Bug 836774 Opened 7 years ago Closed 7 years ago

IonMonkey: Assertion failure: !"unexpected type", at ion/Lowering.cpp:1224

Categories

(Core :: JavaScript Engine, defect, critical)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla21

People

(Reporter: decoder, Assigned: bhackett)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])

Attachments

(1 file)

The following testcase asserts on mozilla-central revision 20bbf73921f4 (run with --ion-eager):


x = ''.charCodeAt(NaN);
evaluate("for each (var e in [{}, {}, {}, {}, x]) {}");
Whiteboard: [jsbugmon:update,bisect]
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   120310:d7dd65663469
user:        Brian Hackett
date:        Tue Jan 29 16:20:03 2013 -0700
summary:     Bug 833898 - Allow converting mixed arrays of ints and doubles to uniform doubles, r=jandem.

This iteration took 0.524 seconds to run.
Brian, do you think bug 833898 is a likely regressor?
Blocks: 349611, 833898
Flags: needinfo?(bhackett1024)
Keywords: regression
OS: Linux → All
Hardware: x86 → All
Attached patch patchSplinter Review
MToDouble isn't robust enough to cope with object or string inputs.  This patch boxes them into arbitrary values, which are handled by ToDouble.
Assignee: general → bhackett1024
Attachment #708687 - Flags: review?(jdemooij)
Flags: needinfo?(bhackett1024)
Comment on attachment 708687 [details] [diff] [review]
patch

Review of attachment 708687 [details] [diff] [review]:
-----------------------------------------------------------------

Type analysis may insert ToDouble instructions as well, not sure if it calls adjustInputs on them. Here you insert MToDouble during IonBuilder so this is fine.

Can you grep for "JS_ASSERT(!" in Lowering.cpp and change these to JS_NOT_REACHED? r=me with that.
Attachment #708687 - Flags: review?(jdemooij) → review+
https://hg.mozilla.org/mozilla-central/rev/6123591fafb8
Status: NEW → RESOLVED
Closed: 7 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla21
You need to log in before you can comment on or make changes to this bug.