862708 - Crash [@ js::ion::ParallelArrayVisitor::visitCall] or Assertion failure: calleeTypes, at ion/ParallelArrayAnalysis.cpp with bug 804676 fixes

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: debug and opt stacks

try {
    ParallelArray(9, wrapWithProto(function () {}, function () {}))
} catch (e) {}

asserts js debug shell on ionmonkey (where bug 804676 fixes landed for testing) changeset d746d516bf55 without any CLI arguments at Assertion failure: calleeTypes, at ion/ParallelArrayAnalysis.cpp and crashes js opt shell at js::ion::ParallelArrayVisitor::visitCall

Comment 1

[Brian Hackett [Laid off!]]

Attachment: patch

Fix this and bug 862699.  Both are simple issues.

https://hg.mozilla.org/projects/ionmonkey/rev/ae6a2cf914f7