579646 - TM: "Assertion failure: hasInt32Repr(*vp),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

for (a = 0; a < 9; a++)
for (b = 0; b < 1; b++)
for (c = 0; c < 2; c++)
gczeal();
for each(e in [NaN])
for (d = 0; d < 1; d++)
z = 0;
for (w in [0, 0])
{}
x = 0;
for (e = 0; e < 3; e++)
for (f = 0; f < 4; f++)
x = -x

asserts js debug shell on TM tip with -j at Assertion failure: hasInt32Repr(*vp), at ../jstracer.cpp:4026

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   47546:9c869e64ee26
user:        Luke Wagner
date:        Wed Jul 14 23:19:36 2010 -0700
summary:     Bug 549143 - fatvals

Comment 2

[Luke Wagner [:luke]]

Attachment: fix

The issue here is that, after fatvals, while the engine generally tries to put integral doubles into ints, the engine does not maintain the rigid invariant that a double never holds an int.  That means, in record_JSOP_NEG, the following condition which is supposed to catch 0 <==> -0 was valid before and now not:

          * If we're a promoted integer, we have to watch out for 0s since -0 is
          * a double. Only follow this path if we're not an integer that's 0 and
          * we're not a double that's zero.
          */
         if (oracle &&
             !oracle->isInstructionUndemotable(cx->regs->pc) &&
             isPromoteInt(a) &&
             (!v.isInt32() || v.toInt32() != 0) &&
             (!v.isDouble() || !JSDOUBLE_IS_NEGZERO(v.toDouble())) &&  // ***
             -v.toNumber() == (int)-v.toNumber())
         {

IIUC, the simple fix is to replace "!JSDOUBLE_IS_NEGZERO(...)" with "v.toDouble() != 0".  Why the original code insisted on checking the (slower) more exact condition, I do not know.

Comment 3

[Luke Wagner [:luke]]

Attachment: fix and testcase

Forgot to include Gary's fine test case!

Comment 4

[Luke Wagner [:luke]]

http://hg.mozilla.org/tracemonkey/rev/abc227b2380f

Comment 5

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/abc227b2380f

Comment 6

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug579646.js.