Closed
Bug 741202
Opened 12 years ago
Closed 12 years ago
IonMonkey: Assertion failure: NYI, at ion/Lowering.cpp:480
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: decoder, Assigned: nbp)
References
Details
(Keywords: assertion, testcase)
Attachments
(1 file, 1 obsolete file)
12.80 KB,
patch
|
jandem
:
review+
|
Details | Diff | Splinter Review |
The following testcase asserts on ionmonkey revision e96d5b1f47b8 (run with --ion -n -m): function check(b, desc) { function ownProperties(obj) { return Object.getOwnPropertyNames(obj). map(function (p) { return [p, Object.getOwnPropertyDescriptor(obj, p)]; }); } function notIndex(p) { var u = p >>> 0; } function assertIsCloneOf(a, b, path) { var pa = ownProperties(a); var aNames = pa.map(function (pair) { return pair[1]; }).filter(notIndex); var bNames = pa.map(function (pair) { return pair[1]; }).filter(notIndex); } var banner = "while testing clone of " + (desc || uneval(b)); var a = deserialize(serialize(b)); var queue = [[a, b, banner]]; var triple = queue.shift(); assertIsCloneOf(triple[0], triple[1], triple[2]); } check({x: 0.7, p: "forty-two", y: null, z: undefined}); check([0, 1, 2, , 4, 5, 6]);
Assignee | ||
Comment 1•12 years ago
|
||
Test ./jit-test/tests/jaeger/bug593554.js fails identically with --ion --ion-eager -n.
Assignee | ||
Comment 2•12 years ago
|
||
Reuse BitOpV LIR, because MShiftOp use the Bitwise policy and as the same signature.
Attachment #612772 -
Flags: review?(dvander)
Updated•12 years ago
|
Attachment #612772 -
Flags: review?(dvander) → review+
Comment 3•12 years ago
|
||
A problem with >>> is that it can return double values if the RHS is 0, see this testcase: function ursh(x, y) { return x >>> y; }; var o = {valueOf: function() { return -0x80000000; }}; for (var i=0; i<70; i++) assertEq(ursh(o, 0), 0x80000000);
Assignee | ||
Comment 4•12 years ago
|
||
Use LBinaryV instead of LBitOpV for the Value implementation of Ursh. - Fix issue in MUrsh::canOverflow (assumed that all constants were int32) - Fix issue in MIR shift annotations (MLsh, MRsh, MUrsh defined as commutative by MBinaryBitwiseInstruction::infer)
Attachment #612772 -
Attachment is obsolete: true
Attachment #613029 -
Flags: review?(jdemooij)
Updated•12 years ago
|
Attachment #613029 -
Flags: review?(jdemooij) → review+
Assignee | ||
Comment 5•12 years ago
|
||
https://hg.mozilla.org/projects/ionmonkey/rev/49c6f796e3fc
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Reporter | ||
Comment 6•11 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug741202.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•