454044 - TM: JSOP_NOT needs more type support

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Brendan Eich [:brendan]]

Attachment: fix

Crashing in nanojit with a LIR_eq whose left operand is quad but whose right is short is no fun.

/be

Comment 1

[Brendan Eich [:brendan]]

Fixed on tracemonkey:

http://hg.mozilla.org/tracemonkey/rev/b776e26bb8ea

/be

Comment 2

[Brendan Eich [:brendan]]

Fixed on m-c:

http://hg.mozilla.org/mozilla-central/rev/b776e26bb8ea

/be

Comment 3

[Boris Zbarsky [:bzbarsky]]

So how come the explicit demote is needed here?  Where do we decide what the right operand should be?  It needs to be a quad for doubles, right?  How come whatever code is making that decision isn't massaging the left operand to suit?

Comment 4

[Andreas Gal :gal]

The code was dead wrong. This is how it should be:

bool
TraceRecorder::record_JSOP_NOT()
{
    jsval& v = stackval(-1);
    if (JSVAL_TAG(v) == JSVAL_BOOLEAN) {
        set(&v, lir->ins_eq0(lir->ins2i(LIR_eq, get(&v), 1)));
        return true;
    } 
    if (isNumber(v)) {
        set(&v, lir->ins2(LIR_feq, get(&v), lir->insImmq(0)));
        return true;
    } 
    if (JSVAL_IS_OBJECT(v)) {
        set(&v, lir->ins_eq0(get(&v)));
        return true;
    }
    if (JSVAL_IS_STRING(v)) {
        set(&v, lir->ins_eq0(lir->ins2(LIR_piand, 
                lir->insLoad(LIR_ldp, get(&v), (int)offsetof(JSString, length)),
                INS_CONSTPTR(JSSTRING_LENGTH_MASK))));
        return true;
    }
    return false;
}

Comment 5

[Brendan Eich [:brendan]]

I gave r+ over IRC and Andreas fixed. Adjusting summary.

/be