491084 - assertion when jitting null % (modulo) null

Status: VERIFIED FIXED

(Tamarin Graveyard :: Baseline JIT (CodegenLIR), defect, P1)

Description

[Chris Peyer]

as:
null % null;

or with abcasm:
pushnull
pushnull
modulo

Run with -Ojit.

Result:
Assertion failed: (_allocator.active[FST0] && _fpuStkDepth == -1) || (!_allocator.active[FST0] && _fpuStkDepth == 0) (/Users/build/buildbot/tamarin-redux/mac-intel-10_5/tamarin-redux/nanojit/Assembler.cpp:436)
Abort trap

Comment 1

[Tom Harwood]

Cannot repro on Win32, Linux/IA32 or Beagleboard Linux/ARM.  Chris, are you still seeing this?  If so, xfer back to me, I will have a Mac in a week or so.

Comment 2

[Dan Smith]

Chris, Please confirm.

Comment 3

[Chris Peyer]

Repro'd with TR 2622  on OSX 10.5 intel - slightly different line number:

$ avmshell_sd -Ojit  t.abc 
Assertion failed: (_allocator.active[FST0] && _fpuStkDepth == -1) || (!_allocator.active[FST0] && _fpuStkDepth == 0) (/Users/build/buildbot/tamarin-redux/mac-intel-10_5/tamarin-redux/nanojit/Assembler.cpp:271)
Abort trap

Comment 4

[Edwin Smith]

i'm 90% certian i've seen the fix for this in tracemonkey's nanojit, it was originally found by jsfunfuz and i think the bug is in asm_call when pushing the same FPU value twice as an argument to fmod(), when the value is in x87 FPU register st(0).  (we try to pop the value twice). 

see also: bug 506146, bug 465484

Comment 7

[Edwin Smith]

fixed by http://hg.mozilla.org/tamarin-redux/rev/6e89a44f87de

Comment 8

[Chris Peyer]

Attachment: Testcase for bug

Add testcases for null to test/acceptance/ecma3/Expressions/e11_5_3.as

Comment 9

[Chris Peyer]

Verified fixed redux 2951

Comment 10

[Chris Peyer]

Testcase pushed redux changeset 2957	e0ea1d43a025