Closed Bug 454044 Opened 14 years ago Closed 14 years ago

TM: JSOP_NOT needs more type support

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla1.9.1b1

People

(Reporter: brendan, Assigned: brendan)

References

()

Details

Attachments

(1 file)

Attached patch fixSplinter Review
Crashing in nanojit with a LIR_eq whose left operand is quad but whose right is short is no fun.

/be
Attachment #337271 - Flags: review?(danderson)
Attachment #337271 - Flags: review?(danderson) → review+
Fixed on m-c:

http://hg.mozilla.org/mozilla-central/rev/b776e26bb8ea

/be
Status: ASSIGNED → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Flags: in-testsuite-
Flags: in-litmus-
So how come the explicit demote is needed here?  Where do we decide what the right operand should be?  It needs to be a quad for doubles, right?  How come whatever code is making that decision isn't massaging the left operand to suit?
The code was dead wrong. This is how it should be:

bool
TraceRecorder::record_JSOP_NOT()
{
    jsval& v = stackval(-1);
    if (JSVAL_TAG(v) == JSVAL_BOOLEAN) {
        set(&v, lir->ins_eq0(lir->ins2i(LIR_eq, get(&v), 1)));
        return true;
    } 
    if (isNumber(v)) {
        set(&v, lir->ins2(LIR_feq, get(&v), lir->insImmq(0)));
        return true;
    } 
    if (JSVAL_IS_OBJECT(v)) {
        set(&v, lir->ins_eq0(get(&v)));
        return true;
    }
    if (JSVAL_IS_STRING(v)) {
        set(&v, lir->ins_eq0(lir->ins2(LIR_piand, 
                lir->insLoad(LIR_ldp, get(&v), (int)offsetof(JSString, length)),
                INS_CONSTPTR(JSSTRING_LENGTH_MASK))));
        return true;
    }
    return false;
}
I gave r+ over IRC and Andreas fixed. Adjusting summary.

/be
Summary: TM: JSOP_NOT needs isPromoteInt/::demote help → TM: JSOP_NOT needs more type support
You need to log in before you can comment on or make changes to this bug.