Closed
Bug 456477
Opened 16 years ago
Closed 16 years ago
TM: "Assertion failure: (m != JSVAL_INT) || isInt32(*vp)" with (0/0)%(-1)
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: jruderman, Assigned: gal)
Details
(Keywords: assertion, crash, testcase)
Symptoms similar to bug 455758, which was fixed a few days ago. ~/tracemonkey/js/src/js -j js> for (var j = 0; j < 5; ++j) { var t = (0 / 0) % (-1); } Assertion failure: (m != JSVAL_INT) || isInt32(*vp), at jstracer.cpp:1642 js> (function() { for (var j = 0; j < 5; ++j) { (0 / 0) % (-1); } })() Floating point exception [@ js_imod] Why is -1 special? I don't get the same crash with other numbers, such as 1 or -2.
Assignee | ||
Updated•16 years ago
|
Assignee: general → gal
Assignee | ||
Comment 1•16 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/3bba1048dc29
Status: NEW → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
Comment 2•16 years ago
|
||
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-456477-01.js,v <-- regress-456477-01.js initial revision: 1.1 Checking in js1_5/Regress/regress-456477-02.js; /cvsroot/mozilla/js/tests/js1_5/Regress/regress-456477-02.js,v <-- regress-456477-02.js initial revision: 1.1 http://hg.mozilla.org/mozilla-central/rev/b04c04268a94
Flags: in-testsuite+
Flags: in-litmus-
You need to log in
before you can comment on or make changes to this bug.
Description
•