617670 - TypeInference: Assertion failure: op == JSOP_DIV

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

---
var y = -null - y;
assertEq(y, NaN);
---
Assertion failure: op == JSOP_DIV, at ../methodjit/FastArithmetic.cpp:389

Comment 1

[Brian Hackett [Laid off!]]

Attachment: fix

This fixes the Compiler to abort and retry in case of static overflow, instead of skipping the fold and proceeding as normal.  This approach is still kind of lame; the best thing to do is get the emitter to do constant and copy propagation.

http://hg.mozilla.org/projects/jaegermonkey/rev/c247104a1499