Closed Bug 452573 Opened 11 years ago Closed 11 years ago

TM: various assertions with "typeof void ..."

Categories

(Core :: JavaScript Engine, defect, critical)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: jruderman, Assigned: mrbkap)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

p.js:
for(var j=0;j<5;++j) typeof void /x/;

q.js:
for(var j=0;j<5;++j) typeof void 1;

$ ./js -j p.js
Assertion failure: JSVAL_IS_VOID(boxed) || JSVAL_IS_BOOLEAN(boxed), at jsbuiltins.cpp:577
Trace/BPT trap

$ ./js -j q.js
Assertion failed: "(((rmask(rr) & FpRegs) != 0))" ("nanojit/Nativei386.cpp":738)
nanojit/Nativei386.cpp:738: failed assertion `0'
Abort trap

I can't reproduce the bugs by pasting, only by feeding files to the js shell.
Attached patch Proposed fixSplinter Review
TraceRecorder::record_JSOP_VOID expects the JSOP_VOID case in the interpreter to push the void value (I think that's why it assigns to stackdepth 0). This isn't true, so when we end up in TraceRecorder::record_JSOP_TYPEOF, we get a LIns for some random stack slot and call TypeOfBoolean with an uninitialized value.
Assignee: general → mrbkap
Status: NEW → ASSIGNED
Attachment #335937 - Flags: review?(gal)
Attachment #335937 - Flags: review?(gal) → review+
http://hg.mozilla.org/tracemonkey/index.cgi/rev/26fa7d8bb115
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-452573-01.js,v  <--  regress-452573-01.js
initial revision: 1.1

/cvsroot/mozilla/js/tests/js1_5/Regress/regress-452573-02.js,v  <--  regress-452573-02.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/c705a2fdffe7
Flags: in-testsuite+
Flags: in-litmus-
You need to log in before you can comment on or make changes to this bug.