We already ignore inputs with empty type sets inside IonBuilder, but we don't do this when applying type information. This causes some unfortunate code to be generated; take this snippet: var foo; if (cond) foo = 0; else foo = SomeNeverExecutedFunction(); print("" + foo); Assuming cond is always true, during IonBuilder, the phi for foo is Int32 because we never run the other branch. We generate an MConcat for the +. After applying type info, the phi is now MIRType_Value, and we inserted an MBox for foo = 0. MConcat's type policy then generates an MUnbox (to String! lol) for foo, and we always bail out during execution.
Created attachment 781868 [details] [diff] [review] v0
Assignee: general → shu
Attachment #781868 - Flags: review?(jdemooij)
Attachment #781868 - Flags: review?(jdemooij) → review+
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla25
You need to log in before you can comment on or make changes to this bug.