Attached test case trips this assert on IonMonkey tip. Filed by request, since it wasn't known that this could happen.

For some reason I left an important part out of the initial bailouts patch: slots can be constants in which case they are neither in memory nor in a register. But they still have to be rematerialized in a bailout. This patch introduces a constant pool in IonScript. The pool is avoided for small integers and as usual there is a little bitpacking in the snapshot for compression. Also, I removed the existing double pool from x86 since it can now use the constant pool. DeferredData is now no longer used, but I'm leaving it in for now. It might come in handy for the ARM port or some future op, and if not we can tear it out later (it's not very big).

Comment on attachment 552039 [details] [diff] [review] fix Review of attachment 552039 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/ion/Snapshots.cpp @@ +75,5 @@ > // If "reg" is InvalidReg1, this byte is followed by a [vws] > // stack offset. Otherwise, "reg" encodes a GPR register. > // > // JSVAL_TYPE_NULL: > +// Reg field: "Reg value" please -- at first glance it looks like the numbers are referring to a bitfield. Also comment that this encodes small Int32 constants (as opposed to Int32 values with other significance). @@ +83,2 @@ > // > // JSVAL_TYPE_UNDEFINED: "Reg value:".