The default bug view has changed. See this FAQ.

TM: "Assertion failed: cond->isCond()" with "if(undefined < false)"

VERIFIED FIXED in mozilla1.9.1b2

Status

()

Core
JavaScript Engine
P1
critical
VERIFIED FIXED
9 years ago
9 years ago

People

(Reporter: Jesse Ruderman, Assigned: gal)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla1.9.1b2
x86
Mac OS X
assertion, testcase
Points:
---
Bug Flags:
in-testsuite +
in-litmus -

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

9 years ago
$ ./js -j
js> for (var j = 0; j < 4; ++j) { if (undefined < false) { } }

Assertion failed: cond->isCond() (nanojit/Assembler.cpp:1228)
(Reporter)

Updated

9 years ago
Summary: "Assertion failed: cond->isCond()" with "if(undefined < false)" → TM: "Assertion failed: cond->isCond()" with "if(undefined < false)"
(Assignee)

Updated

9 years ago
Assignee: general → gal
Flags: blocking1.9.1?
Priority: -- → P1
Target Milestone: --- → mozilla1.9.1b2
(Assignee)

Comment 1

9 years ago
Created attachment 342130 [details] [diff] [review]
Add missing comparison before guarding on the result of the conditional move.
Attachment #342130 - Flags: review?(danderson)
Attachment #342130 - Flags: review?(danderson) → review+
(Assignee)

Comment 2

9 years ago
From this day on forward, I shall never write a JIT again without Jesse.

http://hg.mozilla.org/tracemonkey/rev/c3c2752185c3
Status: NEW → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → FIXED

Comment 3

9 years ago
this still occurs on mozilla-central. when will tm by synced with mc?

Comment 4

9 years ago
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-457778.js,v  <--  regress-457778.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/b04c04268a94
Flags: in-testsuite+
Flags: in-litmus-
Flags: blocking1.9.1?

Comment 5

9 years ago
v 1.9.1 mozilla-central and tracemonkey
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.