Closed Bug 729573 Opened 12 years ago Closed 12 years ago

IonMonkey: Assertion failure: NYI, at js/src/ion/Lowering.cpp:359

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86_64
Linux
defect
Not set
major

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Assigned: dvander)

References

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

The following testcase asserts on ionmonkey revision ca97bbcd6b90 (run with --ion -n -m), tested on 64 bit:


function TestCase(n, d, e, a)
function writeHeaderToLog( string ) {}
var SECTION = "11.7.2";
for ( power = 0; power <= 32; power++ ) {
  shiftexp = Math.pow( 2, power );
  for ( addexp = 0; addexp <= 32; addexp++ ) {
    new TestCase( SECTION, SignedRightShift( shiftexp, addexp ), shiftexp >> addexp );
  }
}
function ToInt32BitString( n ) {
  var b = "";
  return b;
}
function SignedRightShift( s, a ) {
  s = ToInt32BitString( s );
  s = s.substring( 0, 1 | Math && 0xffffffff + 2 );
}
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #599860 - Flags: review?(jdemooij)
Comment on attachment 599860 [details] [diff] [review]
introduce LBitOpV

Review of attachment 599860 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/CodeGenerator.cpp
@@ +2006,5 @@
> +    typedef bool (*pf)(JSContext *, const Value &, const Value &, int *p);
> +    VMFunction info;
> +    switch (lir->jsop()) {
> +      case JSOP_BITAND:
> +        info = FunctionInfo<pf>(BitAnd);

I did something similar for the comparison ops, but it turned out to be a problem since VMFunction's are keyed on their address (so we could sometimes get another wrapper from the wapper hashtable if the same stack address is used for two different ops). Doing something like BinaryV/CompareV ensures they have a different address.

::: js/src/jsval.h
@@ -593,5 @@
>  
>  static JS_ALWAYS_INLINE JSBool
>  JSVAL_IS_SPECIFIC_BOOLEAN(jsval_layout l, JSBool b)
>  {
> -    JS_ASSERT_IF(l.s.tag == JSVAL_TAG_BOOLEAN, l.s.payload.boo == !!l.s.payload.boo);

Why this change?
Attachment #599860 - Flags: review?(jdemooij) → review+
(In reply to Jan de Mooij (:jandem) from comment #2)
> I did something similar for the comparison ops, but it turned out to be a
> problem since VMFunction's are keyed on their address (so we could sometimes
> get another wrapper from the wapper hashtable if the same stack address is
> used for two different ops). Doing something like BinaryV/CompareV ensures
> they have a different address.

Whoops, thanks.

> >  static JS_ALWAYS_INLINE JSBool
> >  JSVAL_IS_SPECIFIC_BOOLEAN(jsval_layout l, JSBool b)
> >  {
> > -    JS_ASSERT_IF(l.s.tag == JSVAL_TAG_BOOLEAN, l.s.payload.boo == !!l.s.payload.boo);
> 
> Why this change?

While tracking down a bug I did a diff against m-c, so this is just merge gunk.
http://hg.mozilla.org/projects/ionmonkey/rev/750ad8a2d0f0
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug729573.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.