Closed Bug 452884 Opened 11 years ago Closed 11 years ago

TM: "Assertion failure: (*m != JSVAL_INT) || isInt32(*vp)" with switch

Categories

(Core :: JavaScript Engine, defect, critical)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: jruderman, Assigned: dvander)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

./js -j
js> for (var j=0;j<5;++j) { switch(1.1) { case NaN: case 2: } }
Assertion failed: "Should not move data from GPR to XMM": false (nanojit/Nativei386.cpp:1139)

./js -j
js> for (var j=0;j<5;++j) { switch(1.1) { case 2: case NaN: } }
Assertion failure: (*m != JSVAL_INT) || isInt32(*vp), at jstracer.cpp:1397

(Same assertions as these FIXED bugs: bug 452170, bug 452713.)
For posterity: Problem here is that the JSOP_CASE and JSOP_CASEX implementations in the recorder don't look at what the interpreter is putting on the stack.  The equal() call places a comparison on the tracker, but the interpreter doesn't get a chance to actually update the stack before ifop() is called.  This results in a type mismatch and both of these assertions should be related.
Now I get this instead:

Assertion failed: "need a way to EOT now, since this is trace end": 0 (nanojit/LIR.cpp:868)
Pushed fix as changeset badf4c84665f.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-452884-01.js,v  <--  regress-452884-01.js
initial revision: 1.1

/cvsroot/mozilla/js/tests/js1_5/Regress/regress-452884-02.js,v  <--  regress-452884-02.js
initial revision: 1.1

m-c: changeset:   19312:599eaa25f27e
Flags: in-testsuite+
Flags: in-litmus-
Assignee: general → danderson
You need to log in before you can comment on or make changes to this bug.