847425 - BaselineCompiler: Assertion failure: type == MIRType_Boolean || type == MIRType_Int32 || type == MIRType_Double || type == MIRType_String || type == MIRType_Object, at ion/MIR.h:1767 with OOM

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on baseline compiler branch revision a956beaa9efd (run with --ion-eager):


gcparam("maxBytes", gcparam("gcBytes") + 4*1024);
var max = 400; 
function f(b) {
    if (b) {
        f(b - 1);
    } else {
        g = {
            apply:function(x,y) {            }
        };
    }
    g.apply(null, arguments);
}
f(max - 1);

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Patch

We have to check the result of GuardFunApplyArgumentsOptimization since it's fallible.

Comment 2

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/projects/ionmonkey/rev/c0197fba12c9