Closed Bug 844360 Opened 11 years ago Closed 11 years ago

OdinMonkey: Assertion failure: isInt32(), at js/Value.h:1087

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86_64
Linux
defect
Not set
major

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Unassigned)

References

Details

(Keywords: assertion, testcase, Whiteboard: [jsbugmon:ignore])

The following testcase asserts on odinmonkey revision d9cbf6bad8c0 (run with ):


var asm = (function(global, env, buffer) {
  'use asm';
  var HEAP32 = new global.Int32Array(buffer);
  var tempInt = 0, 
  tempDouble = 0.0;
  var _printf = env._printf;
  function stackRestore(top) {
    top = top|0;
  _printf((
    HEAP32[tempInt + 12 >> 2] = ! 2147483648, 
    tempInt
   ) | 0) | 0;
  }
  return {};
}, 
buffer);
Ah, great case!  I already fixed the constant-evaluated-compare, but I forgot about the other boolean-producing op.  Man, fuzzing.

http://hg.mozilla.org/users/lwagner_mozilla.com/odinmonkey/rev/6de7e7d56de0
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.