722260 - Assertion failure: a.asBits == b.asBits, at js/src/builtin/MapObject.cpp:99

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test asserts on mozilla-central revision 8a59519e137e (options -m -n):


var m = new Map;
var key = -((/\u0024/ ).x);
var v = {};
m.set(key,v);

Comment 1

[Jeff Walden [:Waldo]]

  var key = -((/\u0024/ ).x);

creates a canonical NaN value, then negates it to get the canonical NaN with the sign bit set.  Luke says our value encoding system correctly treats such bit patterns as doubles, so it's not a problem on that account.  This does mean, however, that given a double value generated by script, it's not possible to simply assert that d == JS_CANONICALIZE_NaN(d).

Comment 2

[Jeff Walden [:Waldo]]

Attachment: Patch with tests

Comment 3

[Jeff Walden [:Waldo]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f3ceed05f6b7

If we're going to have Map and Set on aurora until shortly before merge to beta, it might be worth taking this there, since it seems like something that might easily be stumbled upon.  Not sure about that.  I guess for now I'll default to doing nothing.

Comment 4

[Matt Brubeck (:mbrubeck)]

Sorry, had to back this out on inbound because it (or something it landed with) had some jsreftest issues:
https://hg.mozilla.org/integration/mozilla-inbound/rev/a22cb315b248

Comment 5

[Jeff Walden [:Waldo]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/19addd0f1a6d

Aside from the missing-from-the-commit manifests (easy to solve), it turns out that if you add a new directory of JS tests, you have to add the directory to js/src/tests/Makefile.in, else the tests won't be packaged and test machines will complain your tests are missing.  Ugh; I added a comment to js/src/tests/jstests.list to hopefully ward others away from this problem in the future.

Comment 6

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/19addd0f1a6d

Comment 7

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929