456477 - TM: "Assertion failure: (m != JSVAL_INT) || isInt32(*vp)" with (0/0)%(-1)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Symptoms similar to bug 455758, which was fixed a few days ago.

~/tracemonkey/js/src/js -j

js> for (var j = 0; j < 5; ++j) { var t = (0 / 0) % (-1); }
Assertion failure: (m != JSVAL_INT) || isInt32(*vp), at jstracer.cpp:1642

js> (function() { for (var j = 0; j < 5; ++j) { (0 / 0) % (-1); } })()
Floating point exception [@ js_imod]

Why is -1 special?  I don't get the same crash with other numbers, such as 1 or -2.

Comment 1

[Andreas Gal :gal]

http://hg.mozilla.org/tracemonkey/rev/3bba1048dc29

Comment 2

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_5/Regress/regress-456477-01.js,v  <--  regress-456477-01.js
initial revision: 1.1

Checking in js1_5/Regress/regress-456477-02.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-456477-02.js,v  <--  regress-456477-02.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/b04c04268a94