844360 - OdinMonkey: Assertion failure: isInt32(), at js/Value.h:1087

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on odinmonkey revision d9cbf6bad8c0 (run with ):


var asm = (function(global, env, buffer) {
  'use asm';
  var HEAP32 = new global.Int32Array(buffer);
  var tempInt = 0, 
  tempDouble = 0.0;
  var _printf = env._printf;
  function stackRestore(top) {
    top = top|0;
  _printf((
    HEAP32[tempInt + 12 >> 2] = ! 2147483648, 
    tempInt
   ) | 0) | 0;
  }
  return {};
}, 
buffer);

Comment 1

[Luke Wagner [:luke]]

Ah, great case!  I already fixed the constant-evaluated-compare, but I forgot about the other boolean-producing op.  Man, fuzzing.

http://hg.mozilla.org/users/lwagner_mozilla.com/odinmonkey/rev/6de7e7d56de0