Closed
Bug 729573
Opened 12 years ago
Closed 12 years ago
IonMonkey: Assertion failure: NYI, at js/src/ion/Lowering.cpp:359
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: decoder, Assigned: dvander)
References
Details
(Keywords: assertion, testcase)
Attachments
(1 file)
15.92 KB,
patch
|
jandem
:
review+
|
Details | Diff | Splinter Review |
The following testcase asserts on ionmonkey revision ca97bbcd6b90 (run with --ion -n -m), tested on 64 bit: function TestCase(n, d, e, a) function writeHeaderToLog( string ) {} var SECTION = "11.7.2"; for ( power = 0; power <= 32; power++ ) { shiftexp = Math.pow( 2, power ); for ( addexp = 0; addexp <= 32; addexp++ ) { new TestCase( SECTION, SignedRightShift( shiftexp, addexp ), shiftexp >> addexp ); } } function ToInt32BitString( n ) { var b = ""; return b; } function SignedRightShift( s, a ) { s = ToInt32BitString( s ); s = s.substring( 0, 1 | Math && 0xffffffff + 2 ); }
Assignee | ||
Comment 1•12 years ago
|
||
Comment 2•12 years ago
|
||
Comment on attachment 599860 [details] [diff] [review] introduce LBitOpV Review of attachment 599860 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/ion/CodeGenerator.cpp @@ +2006,5 @@ > + typedef bool (*pf)(JSContext *, const Value &, const Value &, int *p); > + VMFunction info; > + switch (lir->jsop()) { > + case JSOP_BITAND: > + info = FunctionInfo<pf>(BitAnd); I did something similar for the comparison ops, but it turned out to be a problem since VMFunction's are keyed on their address (so we could sometimes get another wrapper from the wapper hashtable if the same stack address is used for two different ops). Doing something like BinaryV/CompareV ensures they have a different address. ::: js/src/jsval.h @@ -593,5 @@ > > static JS_ALWAYS_INLINE JSBool > JSVAL_IS_SPECIFIC_BOOLEAN(jsval_layout l, JSBool b) > { > - JS_ASSERT_IF(l.s.tag == JSVAL_TAG_BOOLEAN, l.s.payload.boo == !!l.s.payload.boo); Why this change?
Attachment #599860 -
Flags: review?(jdemooij) → review+
Assignee | ||
Comment 3•12 years ago
|
||
(In reply to Jan de Mooij (:jandem) from comment #2) > I did something similar for the comparison ops, but it turned out to be a > problem since VMFunction's are keyed on their address (so we could sometimes > get another wrapper from the wapper hashtable if the same stack address is > used for two different ops). Doing something like BinaryV/CompareV ensures > they have a different address. Whoops, thanks. > > static JS_ALWAYS_INLINE JSBool > > JSVAL_IS_SPECIFIC_BOOLEAN(jsval_layout l, JSBool b) > > { > > - JS_ASSERT_IF(l.s.tag == JSVAL_TAG_BOOLEAN, l.s.payload.boo == !!l.s.payload.boo); > > Why this change? While tracking down a bug I did a diff against m-c, so this is just merge gunk.
Assignee | ||
Comment 4•12 years ago
|
||
http://hg.mozilla.org/projects/ionmonkey/rev/750ad8a2d0f0
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Reporter | ||
Comment 5•11 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug729573.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•