455758 - TM: "Assertion failure: (m != JSVAL_INT) || isInt32(*vp)" with %(-0)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

~/tracemonkey/js/src/Darwin_DBG.OBJ/js -j
js> (function() { for (var j = 0; j < 5; ++j) { var t = 3 % (-0); } })()

Assertion failure: (m != JSVAL_INT) || isInt32(*vp), at jstracer.cpp:1571

~/tracemonkey/js/src/Darwin_DBG.OBJ/js -j
js> (function() { for (var j = 0; j < 5; ++j) { 3 % (-0); } })()

Floating point exception: divide by zero [@ js_imod]

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: isPromoteUint should handle -0

Fixes both problems.

Comment 2

[Andreas Gal :gal]

http://hg.mozilla.org/tracemonkey/rev/034e02267810

Comment 3

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_5/Regress/regress-455758-01.js,v  <--  regress-455758-01.js
initial revision: 1.1

/cvsroot/mozilla/js/tests/js1_5/Regress/regress-455758-02.js,v  <--  regress-455758-02.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/6d9b6a1e6cd9