Bug 1033856 - Assertion failure: false (MOZ_ASSERT_UNREACHABLE: unexpected type), at jit/Lowering.cpp:1772 with Symbol. r=jandem.
authorJason Orendorff <jorendorff@mozilla.com>
Thu, 03 Jul 2014 08:24:00 -0500
changeset 217113 4c5ee514a3ac192913db91e945682f66e6eb0990
parent 217112 94b2e3eda6f079e17fbf260c02d45a1020574dda
child 217114 b50f9736768211dad53a558102858eb80053d147
push id515
push userraliiev@mozilla.com
push dateMon, 06 Oct 2014 12:51:51 +0000
treeherdermozilla-release@267c7a481bef [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1033856
milestone33.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1033856 - Assertion failure: false (MOZ_ASSERT_UNREACHABLE: unexpected type), at jit/Lowering.cpp:1772 with Symbol. r=jandem.
js/src/jit-test/tests/symbol/bug-1033856.js
js/src/jit/Lowering.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/symbol/bug-1033856.js
@@ -0,0 +1,6 @@
+function f(x, y) {
+    return x == y;
+}
+f(1.1, 2.2);
+for (var i=0; i<5; i++)
+    f(1, Symbol());
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -1736,16 +1736,17 @@ LIRGenerator::visitToDouble(MToDouble *c
         return assignSnapshot(lir, Bailout_NonPrimitiveInput) && define(lir, convert);
       }
 
       case MIRType_Null:
         JS_ASSERT(conversion != MToDouble::NumbersOnly && conversion != MToDouble::NonNullNonStringPrimitives);
         return lowerConstantDouble(0, convert);
 
       case MIRType_Undefined:
+      case MIRType_Symbol:
         JS_ASSERT(conversion != MToDouble::NumbersOnly);
         return lowerConstantDouble(GenericNaN(), convert);
 
       case MIRType_Boolean:
         JS_ASSERT(conversion != MToDouble::NumbersOnly);
         /* FALLTHROUGH */
 
       case MIRType_Int32:
@@ -1785,16 +1786,17 @@ LIRGenerator::visitToFloat32(MToFloat32 
         return assignSnapshot(lir, Bailout_NonPrimitiveInput) && define(lir, convert);
       }
 
       case MIRType_Null:
         JS_ASSERT(conversion != MToFloat32::NonStringPrimitives);
         return lowerConstantFloat32(0, convert);
 
       case MIRType_Undefined:
+      case MIRType_Symbol:
         JS_ASSERT(conversion != MToFloat32::NumbersOnly);
         return lowerConstantFloat32(GenericNaN(), convert);
 
       case MIRType_Boolean:
         JS_ASSERT(conversion != MToFloat32::NumbersOnly);
         /* FALLTHROUGH */
 
       case MIRType_Int32:
@@ -1957,17 +1959,17 @@ LIRGenerator::visitToString(MToString *i
         if (ins->fallible() && !assignSnapshot(lir, Bailout_NonPrimitiveInput))
             return false;
         if (!define(lir, ins))
             return false;
         return assignSafepoint(lir, ins);
       }
 
       default:
-        // Float32 and objects are not supported.
+        // Float32, symbols, and objects are not supported.
         MOZ_ASSUME_UNREACHABLE("unexpected type");
     }
 }
 
 static bool
 MustCloneRegExpForCall(MCall *call, uint32_t useIndex)
 {
     // We have a regex literal flowing into a call. Return |false| iff