Last Comment Bug 882012 - "asm.js type error: unknown is not a subtype of doublish" when assigning into float*array
: "asm.js type error: unknown is not a subtype of doublish" when assigning into...
Status: RESOLVED FIXED
: testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Mac OS X
: -- normal (vote)
: mozilla24
Assigned To: (PTO until 29th August) Benjamin Bouvier [:bbouvier]
:
Mentors:
Depends on: 882514
Blocks: jsfunfuzz odinfuzz
  Show dependency treegraph
 
Reported: 2013-06-11 20:22 PDT by Jesse Ruderman
Modified: 2013-06-15 09:54 PDT (History)
7 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
proposed fix (4.12 KB, patch)
2013-06-12 15:08 PDT, (PTO until 29th August) Benjamin Bouvier [:bbouvier]
luke: review+
Details | Diff | Splinter Review
same patch with non arrow function in test case (3.61 KB, patch)
2013-06-13 14:03 PDT, (PTO until 29th August) Benjamin Bouvier [:bbouvier]
bbouvier: review+
Details | Diff | Splinter Review

Description Jesse Ruderman 2013-06-11 20:22:03 PDT
var g = (function(stdlib, foreign, heap) {
  "use asm";
  var identity = foreign.identity;
  var doubles = new stdlib.Float64Array(heap);
  function g()
  {
    doubles[0] = identity(2.0);
    return +doubles[0];
  }
  return g;
})(this, {identity: function(x) { return x; }}, new ArrayBuffer(4096));
print(g());

asm.js type error: unknown is not a subtype of doublish

(In other contexts, OdinMonkey seems to be fine with treating unknown as a subtype of doublish, so this is weird.)
Comment 1 Jesse Ruderman 2013-06-11 21:00:20 PDT
Same problem with *int*arrays.
Comment 2 (PTO until 29th August) Benjamin Bouvier [:bbouvier] 2013-06-12 15:08:04 PDT
Created attachment 761734 [details] [diff] [review]
proposed fix
Comment 3 Luke Wagner [:luke] 2013-06-12 15:10:58 PDT
Comment on attachment 761734 [details] [diff] [review]
proposed fix

Thanks Benjamin, perfect fix.

On a style note, I'd prefer if you kept the switch (TypedArrayStoreType()) (the one after the CheckExpr) because that way we get the compiler checking that all the enum values are handled in the switch (and warning if one is missing).
Comment 4 (PTO until 29th August) Benjamin Bouvier [:bbouvier] 2013-06-12 16:24:38 PDT
https://hg.mozilla.org/integration/mozilla-inbound/rev/3dbc486831a4
Comment 5 Matt Brubeck (:mbrubeck) 2013-06-12 17:05:48 PDT
Sorry, backed out because of test failures:
http://hg.mozilla.org/integration/mozilla-inbound/rev/64e8cd80963f

TEST-UNEXPECTED-FAIL | /builds/slave/m-in_lx_sm-warnaserr-000000000/src/js/src/jit-test/tests/asm.js/testHeapAccess.js | --ion-eager: /builds/slave/m-in_lx_sm-warnaserr-000000000/src/js/src/jit-test/lib/asm.js:17:0 warning: successfully compiled asm.js code
TEST-UNEXPECTED-FAIL | /builds/slave/m-in_lx_sm-warnaserr-000000000/src/js/src/jit-test/tests/asm.js/testHeapAccess.js | --baseline-eager --no-ti --no-fpu: /builds/slave/m-in_lx_sm-warnaserr-000000000/src/js/src/jit-test/lib/asm.js:17:0 warning: successfully compiled asm.js code
TEST-UNEXPECTED-FAIL | /builds/slave/m-in_lx_sm-warnaserr-000000000/src/js/src/jit-test/tests/asm.js/testHeapAccess.js | --no-baseline --no-ion: /builds/slave/m-in_lx_sm-warnaserr-000000000/src/js/src/jit-test/lib/asm.js:17:0 warning: successfully compiled asm.js code
TEST-UNEXPECTED-FAIL | /builds/slave/m-in_lx_sm-warnaserr-000000000/src/js/src/jit-test/tests/asm.js/testHeapAccess.js | --no-baseline --no-ion --no-ti: /builds/slave/m-in_lx_sm-warnaserr-000000000/src/js/src/jit-test/lib/asm.js:17:0 warning: successfully compiled asm.js code
TEST-UNEXPECTED-FAIL | /builds/slave/m-in_lx_sm-warnaserr-000000000/src/js/src/jit-test/tests/asm.js/testHeapAccess.js | --baseline-eager: /builds/slave/m-in_lx_sm-warnaserr-000000000/src/js/src/jit-test/lib/asm.js:17:0 warning: successfully compiled asm.js code
https://tbpl.mozilla.org/php/getParsedLog.php?id=24080933&tree=Mozilla-Inbound
Comment 6 (PTO until 29th August) Benjamin Bouvier [:bbouvier] 2013-06-13 14:03:56 PDT
Created attachment 762303 [details] [diff] [review]
same patch with non arrow function in test case

Doh! The tests were failing because of bug 882514. Replaced the arrow function by a lambda, jit-tests now work with --tbpl.

Carrying over r+ from Luke.
Comment 7 (PTO until 29th August) Benjamin Bouvier [:bbouvier] 2013-06-13 14:04:42 PDT
https://hg.mozilla.org/integration/mozilla-inbound/rev/e1c91dd828e8
Comment 8 Ed Morley [:emorley] 2013-06-14 04:16:43 PDT
https://hg.mozilla.org/mozilla-central/rev/e1c91dd828e8

Note You need to log in before you can comment on or make changes to this bug.