Closed Bug 617770 Opened 12 years ago Closed 12 years ago

Assert hasInt32Repr(*vp) when tracing

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
normal

Tracking

()

RESOLVED DUPLICATE of bug 609502

People

(Reporter: decoder, Unassigned)

Details

The following code asserts in shell (tested with tracemonkey tip):

options('tracejit');
var n = -(Math.pow(2, 31));

for (i = 0; i < 9; i++) {
      Math.abs(n) == Number.POSITIVE_INFINITY;
}

Assertion failure: hasInt32Repr(*vp), at jstracer.cpp:4001


The problem seems to be that as soon as the tracer steps in (hence the 8 loop passes), there is a different type of conversion done with Math.abs, trying to convert -2^31 to Int32.
Very likely a dup of bug 609502.
Yup.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.