If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

TM: "Assertion failure: (m != JSVAL_INT) || isInt32(*vp)" with %(-0)

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
9 years ago
9 years ago

People

(Reporter: Jesse Ruderman, Assigned: dvander)

Tracking

(Blocks: 1 bug, {assertion, crash, testcase})

Trunk
x86
Mac OS X
assertion, crash, testcase
Points:
---
Bug Flags:
in-testsuite +
in-litmus -

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

9 years ago
~/tracemonkey/js/src/Darwin_DBG.OBJ/js -j
js> (function() { for (var j = 0; j < 5; ++j) { var t = 3 % (-0); } })()

Assertion failure: (m != JSVAL_INT) || isInt32(*vp), at jstracer.cpp:1571

~/tracemonkey/js/src/Darwin_DBG.OBJ/js -j
js> (function() { for (var j = 0; j < 5; ++j) { 3 % (-0); } })()

Floating point exception: divide by zero [@ js_imod]
(Assignee)

Comment 1

9 years ago
Created attachment 339318 [details] [diff] [review]
isPromoteUint should handle -0

Fixes both problems.
Assignee: general → danderson
Status: NEW → ASSIGNED
Attachment #339318 - Flags: review?(gal)

Updated

9 years ago
Attachment #339318 - Flags: review?(gal) → review+

Comment 2

9 years ago
http://hg.mozilla.org/tracemonkey/rev/034e02267810
Status: ASSIGNED → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → FIXED

Comment 3

9 years ago
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-455758-01.js,v  <--  regress-455758-01.js
initial revision: 1.1

/cvsroot/mozilla/js/tests/js1_5/Regress/regress-455758-02.js,v  <--  regress-455758-02.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/6d9b6a1e6cd9
Flags: in-testsuite+
Flags: in-litmus-
You need to log in before you can comment on or make changes to this bug.