452573 - TM: various assertions with "typeof void ..."

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

p.js:
for(var j=0;j<5;++j) typeof void /x/;

q.js:
for(var j=0;j<5;++j) typeof void 1;

$ ./js -j p.js
Assertion failure: JSVAL_IS_VOID(boxed) || JSVAL_IS_BOOLEAN(boxed), at jsbuiltins.cpp:577
Trace/BPT trap

$ ./js -j q.js
Assertion failed: "(((rmask(rr) & FpRegs) != 0))" ("nanojit/Nativei386.cpp":738)
nanojit/Nativei386.cpp:738: failed assertion `0'
Abort trap

I can't reproduce the bugs by pasting, only by feeding files to the js shell.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix

TraceRecorder::record_JSOP_VOID expects the JSOP_VOID case in the interpreter to push the void value (I think that's why it assigns to stackdepth 0). This isn't true, so when we end up in TraceRecorder::record_JSOP_TYPEOF, we get a LIns for some random stack slot and call TypeOfBoolean with an uninitialized value.

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/tracemonkey/index.cgi/rev/26fa7d8bb115

Comment 3

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_5/Regress/regress-452573-01.js,v  <--  regress-452573-01.js
initial revision: 1.1

/cvsroot/mozilla/js/tests/js1_5/Regress/regress-452573-02.js,v  <--  regress-452573-02.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/c705a2fdffe7