465249 - TM: "Assertion failure: (m != JSVAL_INT) || isInt32(*vp)" adding two large integers

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

js> for (let j = 0; j < 5; ++j) { (0x50505050) + (0x50505050); }
Assertion failure: (m != JSVAL_INT) || isInt32(*vp), at ../jstracer.cpp:1783

This assertion also shows up in bug 464116, but this testcase is simpler.

Comment 1

[Jesse Ruderman]

The testcase in comment 0 only works in the interactive shell.  To reproduce this with a .js file, you'll need something like:

eval("for (let j = 0; j < 5; ++j) { (0x50505050) + (0x50505050); }")

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: proposed fix

The problem was our LIR_fadd/fsub filter would keep LIR_i2f on overflowed constants.  This fix detects overflow and constant folds appropriately.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Pushed fix as changeset: http://hg.mozilla.org/tracemonkey/rev/c86e2bafd736

Comment 4

[Damon Sicore (:damons)]

reopening, marking blocking beta2, will close once landed on m-c.

Comment 5

[Bob Clary [:bc] (inactive)]

damon, I assume you meant to + blocking and not -?

Comment 6

[Bob Clary [:bc] (inactive)]

test landed http://hg.mozilla.org/mozilla-central/rev/164861c1e471 and cvs