617770 - Assert hasInt32Repr(*vp) when tracing

Status: RESOLVED DUPLICATE of bug 609502

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following code asserts in shell (tested with tracemonkey tip):

options('tracejit');
var n = -(Math.pow(2, 31));

for (i = 0; i < 9; i++) {
      Math.abs(n) == Number.POSITIVE_INFINITY;
}

Assertion failure: hasInt32Repr(*vp), at jstracer.cpp:4001


The problem seems to be that as soon as the tracer steps in (hence the 8 loop passes), there is a different type of conversion done with Math.abs, trying to convert -2^31 to Int32.

Comment 1

[Nicholas Nethercote [inactive]]

Very likely a dup of bug 609502.

Comment 2

[Paul Biggar]

Yup.