TM: "Assertion failure: (m != JSVAL_INT) || isInt32(*vp), at ../jstracer.cpp"

RESOLVED DUPLICATE of bug 470409

Status

()

Core
JavaScript Engine
--
critical
RESOLVED DUPLICATE of bug 470409
9 years ago
9 years ago

People

(Reporter: gkw, Assigned: Waldo)

Tracking

(Blocks: 1 bug, {assertion, crash, testcase})

Trunk
x86
Mac OS X
assertion, crash, testcase
Points:
---
Bug Flags:
in-testsuite ?

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

9 years ago
for (var y = 0; y < 2; ++y) { switch(1.3) { default: case 3: break; case false: break; case NaN: break;} }

$ ./js-dbg-tm-intelmac -j
js> for (var y = 0; y < 2; ++y) { switch(1.3) { default: case 3: break; case false: break; case NaN: break;} }
Assertion failure: (m != JSVAL_INT) || isInt32(*vp), at ../jstracer.cpp:1831
Trace/BPT trap

This crashes opt at null at nanojit::Assembler::freeRsrcOf and is TM-only.
Flags: blocking1.9.1?
I could believe this is a variant of bug 470409, but not sure yet...
Assignee: general → jwalden+bmo
Status: NEW → ASSIGNED
Oh, dumb -- l and r are different numeric types compared with ==.  Patching and testing...

Comment 3

9 years ago
I can review for you. Ping me on irc.
Oh, that would probably just result in more aborts than expected due to a mispredicted branch.  Making the change and testing doesn't fix anything, although if I remember stacks right the same assertion is hit at a different location.
Er, "side exits".
The different-types problem is being addressed in bug 470737 with a testcase that more precisely demonstrates the problem.  Otherwise, this was fixed with the change in bug 470409.
Status: ASSIGNED → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 407409

Updated

9 years ago
Duplicate of bug: 470409
(Reporter)

Updated

9 years ago
Flags: in-testsuite?
(Reporter)

Updated

9 years ago
Flags: blocking1.9.1?
You need to log in before you can comment on or make changes to this bug.