Persona is no longer an option for authentication on BMO. For more details see Persona Deprecated.
Last Comment Bug 741202 - IonMonkey: Assertion failure: NYI, at ion/Lowering.cpp:480
: IonMonkey: Assertion failure: NYI, at ion/Lowering.cpp:480
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Linux
: -- major (vote)
: ---
Assigned To: Nicolas B. Pierron [:nbp]
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: langfuzz IonFuzz IonEager
  Show dependency treegraph
Reported: 2012-04-01 08:12 PDT by Christian Holler (:decoder)
Modified: 2013-01-14 07:42 PST (History)
6 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Implement ShiftOp for values operands (3.88 KB, patch)
2012-04-05 18:29 PDT, Nicolas B. Pierron [:nbp]
dvander: review+
Details | Diff | Splinter Review
Implement ShiftOp for values operands (12.80 KB, patch)
2012-04-06 17:06 PDT, Nicolas B. Pierron [:nbp]
jdemooij: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2012-04-01 08:12:19 PDT
The following testcase asserts on ionmonkey revision e96d5b1f47b8 (run with --ion -n -m):

function check(b, desc) {
    function ownProperties(obj) {
        return Object.getOwnPropertyNames(obj).
            map(function (p) { return [p, Object.getOwnPropertyDescriptor(obj, p)]; });
    function notIndex(p) {
        var u = p >>> 0;
    function assertIsCloneOf(a, b, path) {
        var pa = ownProperties(a);
        var aNames = (pair) { return pair[1]; }).filter(notIndex);
        var bNames = (pair) { return pair[1]; }).filter(notIndex);
    var banner = "while testing clone of " + (desc || uneval(b));
    var a = deserialize(serialize(b));
    var queue = [[a, b, banner]];
    var triple = queue.shift();
    assertIsCloneOf(triple[0], triple[1], triple[2]);
check({x: 0.7, p: "forty-two", y: null, z: undefined});
check([0, 1, 2, , 4, 5, 6]);
Comment 1 Nicolas B. Pierron [:nbp] 2012-04-05 17:41:15 PDT
Test ./jit-test/tests/jaeger/bug593554.js fails identically with --ion --ion-eager -n.
Comment 2 Nicolas B. Pierron [:nbp] 2012-04-05 18:29:50 PDT
Created attachment 612772 [details] [diff] [review]
Implement ShiftOp for values operands

Reuse BitOpV LIR, because MShiftOp use the Bitwise policy and as the same signature.
Comment 3 Jan de Mooij [:jandem] 2012-04-05 23:28:27 PDT
A problem with >>> is that it can return double values if the RHS is 0, see this testcase:

function ursh(x, y) { return x >>> y; };
var o = {valueOf: function() { return -0x80000000; }};

for (var i=0; i<70; i++)
    assertEq(ursh(o, 0), 0x80000000);
Comment 4 Nicolas B. Pierron [:nbp] 2012-04-06 17:06:16 PDT
Created attachment 613029 [details] [diff] [review]
Implement ShiftOp for values operands

Use LBinaryV instead of LBitOpV for the Value implementation of Ursh.
- Fix issue in MUrsh::canOverflow (assumed that all constants were int32)
- Fix issue in MIR shift annotations (MLsh, MRsh, MUrsh defined as commutative by MBinaryBitwiseInstruction::infer)
Comment 5 Nicolas B. Pierron [:nbp] 2012-04-09 14:17:21 PDT
Comment 6 Christian Holler (:decoder) 2013-01-14 07:42:10 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug741202.js.

Note You need to log in before you can comment on or make changes to this bug.