BaselineCompiler: Assertion failure: type == MIRType_Boolean || type == MIRType_Int32 || type == MIRType_Double || type == MIRType_String || type == MIRType_Object, at ion/MIR.h:1767 with OOM

RESOLVED FIXED

Status

()

--
major
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: decoder, Assigned: jandem)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Other Branch
x86
Linux
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
The following testcase asserts on baseline compiler branch revision a956beaa9efd (run with --ion-eager):


gcparam("maxBytes", gcparam("gcBytes") + 4*1024);
var max = 400; 
function f(b) {
    if (b) {
        f(b - 1);
    } else {
        g = {
            apply:function(x,y) {            }
        };
    }
    g.apply(null, arguments);
}
f(max - 1);
(Assignee)

Comment 1

6 years ago
Created attachment 723908 [details] [diff] [review]
Patch

We have to check the result of GuardFunApplyArgumentsOptimization since it's fallible.
Assignee: general → jdemooij
Status: NEW → ASSIGNED
Attachment #723908 - Flags: review?(kvijayan)

Updated

6 years ago
Attachment #723908 - Flags: review?(kvijayan) → review+
(Assignee)

Comment 2

6 years ago
https://hg.mozilla.org/projects/ionmonkey/rev/c0197fba12c9
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.