582185 - JM: Assertion failure on comparison between object and double in certain cases

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Andrew Drake [:adrake]]

Test case:

let c = (this != 4.2);

Asserts:

Assertion failure: isInt32(), at /home/adrake/src/moo/js/src/jsvalue.h:511

Fails on x86 and x86_64 methodjit.

Comment 1

[Andrew Drake [:adrake]]

Attachment: Patch.

Fixes the bug and adds it to trace-tests.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 460472 [details] [diff] [review]
Patch.

jsop_relational_int() was all we had before the double comparison patch, and (as it still does) handles unknown types. The real bug must be elsewhere.

Comment 4

[Andrew Drake [:adrake]]

(In reply to comment #2)
> Comment on attachment 460472 [details] [diff] [review]
> Patch.
> 
> jsop_relational_int() was all we had before the double comparison patch, and
> (as it still does) handles unknown types. The real bug must be elsewhere.

I'm not really sure what you mean -- changeset http://hg.mozilla.org/users/danderson_mozilla.com/moo/rev/48742 introduces the jsop_relational_int function and is the first revision to have this regression.

Comment 5

[David Anderson [:dvander] - inactive, e-mail if emergency]

It was jsop_relational() before, it just got renamed to preserve ==, != paths (we don't inline double equality yet).

Comment 6

[David Anderson [:dvander] - inactive, e-mail if emergency]

Stealing - fix was on the right track, jsop_relation_int expects callers to sniff for invalid known types.

http://hg.mozilla.org/users/danderson_mozilla.com/moo/rev/c231ac12da6c