461723 - TM: "Assertion failure: (m != JSVAL_INT) || isInt32(*vp)" with "(0 + void 0) && 0"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

for (var j = 0; j < 3; ++j) { (0 + void 0) && 0; }

Assertion failure: (m != JSVAL_INT) || isInt32(*vp), at jstracer.cpp:1767

I'm using Tracemonkey branch.

Comment 1

[Jason Orendorff [:jorendorff]]

The instruction is an i2f, but the value *vp is NaN.

Taking.

Comment 2

[Jason Orendorff [:jorendorff]]

When recording (0 + NaN), in TraceRecorder::binary, we do this:

    if (l == JSVAL_VOID) {
        a = lir->insImmq(0);
        leftNumber = true;
    }
    if (r == JSVAL_VOID) {
        b = lir->insImmq(0);
        rightNumber = true;
    }

This is wrong in a refreshingly direct way. :) Patch after breakfast.

Comment 3

[Jason Orendorff [:jorendorff]]

Attachment: v1

Comment 4

[Andreas Gal :gal]

Comment on attachment 345112 [details] [diff] [review]
v1

Ouch. I wrote that nonsense not too long ago.

Comment 5

[Jason Orendorff [:jorendorff]]

http://hg.mozilla.org/tracemonkey/rev/782df5db308c

Comment 6

[Bob Clary [:bc] (inactive)]

http://hg.mozilla.org/mozilla-central/rev/37b3fdbb0f07
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-461723.js,v  <--  regress-461723.js
initial revision: 1.1