639808 - TI+JM: op == JSOP_DIV, at ../methodjit/FastArithmetic.cpp:381

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

--
function f() {
    var x = 1.23;
    var y = [].length;
    x = ++y;
    y--;
}
f();
--
Asserts with -n -m -a:
Assertion failure: op == JSOP_DIV, at ../methodjit/FastArithmetic.cpp:381

Comment 1

[Jan de Mooij [:jandem]]

y-- is compiled as y - 1. We know y has type JSVAL_TYPE_INT32 but I suppose the frame entry has type JSVAL_TYPE_DOUBLE. Looks like x has type JSVAL_TYPE_DOUBLE, maybe that has something to do with it.

Comment 2

[Jan de Mooij [:jandem]]

It looks like x = ++y sets y's FrameEntry to type JSVAL_TYPE_DOUBLE but I'm not sure what's the best way to fix this bug.

Comment 3

[Brian Hackett [Laid off!]]

It's super important that the generated code align with the information that we actually inferred --- in this case, making sure that since y was inferred as an int, it always is an int or unknown in the frame state.

In this case, the bug is that the assignment 'x = y' performed after the '++' tries to mark y (an int) as a copy of x (a double) and converts y to a double.  This fixes things so that x ends up an integer, and will get converted to a double by fixDoubleTypes.

http://hg.mozilla.org/projects/jaegermonkey/rev/f2fdb87d75a3

Here is a followup fix for fixDoubleTypes itself, which could now break the invariant again by marking x as an integer before branching.  The fix syncs any copies of fixed frame entries before coercing them to double.

http://hg.mozilla.org/projects/jaegermonkey/rev/03819499ac02