TM: "Assertion failure: (m != JSVAL_INT) || isInt32(*vp)" with "(0 + void 0) && 0"

RESOLVED FIXED

Status

()

defect
--
critical
RESOLVED FIXED
11 years ago
11 years ago

People

(Reporter: jruderman, Assigned: jorendorff)

Tracking

(Blocks 1 bug, {assertion, testcase})

Trunk
x86
macOS
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +
in-litmus -

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

Reporter

Description

11 years ago
for (var j = 0; j < 3; ++j) { (0 + void 0) && 0; }

Assertion failure: (m != JSVAL_INT) || isInt32(*vp), at jstracer.cpp:1767

I'm using Tracemonkey branch.
Assignee

Comment 1

11 years ago
The instruction is an i2f, but the value *vp is NaN.

Taking.
Assignee: general → jorendorff
Assignee

Comment 2

11 years ago
When recording (0 + NaN), in TraceRecorder::binary, we do this:

    if (l == JSVAL_VOID) {
        a = lir->insImmq(0);
        leftNumber = true;
    }
    if (r == JSVAL_VOID) {
        b = lir->insImmq(0);
        rightNumber = true;
    }

This is wrong in a refreshingly direct way. :) Patch after breakfast.
Assignee

Comment 3

11 years ago
Posted patch v1Splinter Review
Attachment #345112 - Flags: review?(gal)

Comment 4

11 years ago
Comment on attachment 345112 [details] [diff] [review]
v1

Ouch. I wrote that nonsense not too long ago.
Attachment #345112 - Flags: review?(gal) → review+
Assignee

Comment 5

11 years ago
http://hg.mozilla.org/tracemonkey/rev/782df5db308c
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED

Comment 6

11 years ago
http://hg.mozilla.org/mozilla-central/rev/37b3fdbb0f07
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-461723.js,v  <--  regress-461723.js
initial revision: 1.1
Flags: in-testsuite+
Flags: in-litmus-
You need to log in before you can comment on or make changes to this bug.