Got this error when running Anion to test a regalloc patch: function f0(p1) { var v0 = (p1 < (p1 / undefined)) + p1; while (v0 / 12) { v0 = 1.7; return; } } f0(354); $ ./js --ion-eager test.js Assertion failure: [infer failure] Missing type pushed 0: float, at jsinfer.cpp:327 Revision 24c81eaaf528, 32-bit OS X. From looking at the testcase, I think we specialize the phi for v0 as double since it has both int32 and double operands. However, since the loop never actually loops, TI probably determined v0 in "v0 / 12" is always int32.

autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 84597:7d3ba6b88798 user: David Anderson date: Thu Jan 05 13:47:34 2012 -0800 summary: Remove type analysis passes that are incompatible with type inference (bug 714393, r=sstangl). Not sure if this is entirely true.

Sweet, this is bug 774644.