452884 - TM: "Assertion failure: (*m != JSVAL_INT) || isInt32(*vp)" with switch

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

./js -j
js> for (var j=0;j<5;++j) { switch(1.1) { case NaN: case 2: } }
Assertion failed: "Should not move data from GPR to XMM": false (nanojit/Nativei386.cpp:1139)

./js -j
js> for (var j=0;j<5;++j) { switch(1.1) { case 2: case NaN: } }
Assertion failure: (*m != JSVAL_INT) || isInt32(*vp), at jstracer.cpp:1397

(Same assertions as these FIXED bugs: bug 452170, bug 452713.)

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

For posterity: Problem here is that the JSOP_CASE and JSOP_CASEX implementations in the recorder don't look at what the interpreter is putting on the stack.  The equal() call places a comparison on the tracker, but the interpreter doesn't get a chance to actually update the stack before ifop() is called.  This results in a type mismatch and both of these assertions should be related.

Comment 2

[Jesse Ruderman]

Now I get this instead:

Assertion failed: "need a way to EOT now, since this is trace end": 0 (nanojit/LIR.cpp:868)

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Pushed fix as changeset badf4c84665f.

Comment 4

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_5/Regress/regress-452884-01.js,v  <--  regress-452884-01.js
initial revision: 1.1

/cvsroot/mozilla/js/tests/js1_5/Regress/regress-452884-02.js,v  <--  regress-452884-02.js
initial revision: 1.1

m-c: changeset:   19312:599eaa25f27e