Last Comment Bug 457778 - TM: "Assertion failed: cond->isCond()" with "if(undefined < false)"
: TM: "Assertion failed: cond->isCond()" with "if(undefined < false)"
Status: VERIFIED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Mac OS X
P1 critical (vote)
: mozilla1.9.1b2
Assigned To: Andreas Gal :gal
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: jsfunfuzz
  Show dependency treegraph
 
Reported: 2008-09-29 17:05 PDT by Jesse Ruderman
Modified: 2008-10-27 15:52 PDT (History)
3 users (show)
bob: in‑testsuite+
bob: in‑litmus-
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Add missing comparison before guarding on the result of the conditional move. (1.05 KB, patch)
2008-10-07 13:25 PDT, Andreas Gal :gal
dvander: review+
Details | Diff | Splinter Review

Description User image Jesse Ruderman 2008-09-29 17:05:38 PDT
$ ./js -j
js> for (var j = 0; j < 4; ++j) { if (undefined < false) { } }

Assertion failed: cond->isCond() (nanojit/Assembler.cpp:1228)
Comment 1 User image Andreas Gal :gal 2008-10-07 13:25:00 PDT
Created attachment 342130 [details] [diff] [review]
Add missing comparison before guarding on the result of the conditional move.
Comment 2 User image Andreas Gal :gal 2008-10-07 13:34:26 PDT
From this day on forward, I shall never write a JIT again without Jesse.

http://hg.mozilla.org/tracemonkey/rev/c3c2752185c3
Comment 3 User image Bob Clary [:bc:] 2008-10-11 05:25:22 PDT
this still occurs on mozilla-central. when will tm by synced with mc?
Comment 4 User image Bob Clary [:bc:] 2008-10-11 21:11:30 PDT
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-457778.js,v  <--  regress-457778.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/b04c04268a94
Comment 5 User image Bob Clary [:bc:] 2008-10-27 15:52:29 PDT
v 1.9.1 mozilla-central and tracemonkey

Note You need to log in before you can comment on or make changes to this bug.