981371 - Fix an assertion that can never fail

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

Attachment: Patch v1

JSVAL_IS_OBJECT_IMPL has (in the x64 representation)

MOZ_ASSERT((l.asBits >> JSVAL_TAG_SHIFT) <= JSVAL_SHIFTED_TAG_OBJECT);

with 

JSVAL_SHIFTED_TAG_OBJECT       = (((uint64_t)JSVAL_TAG_OBJECT)     << JSVAL_TAG_SHIFT)

JSVAL_TAG_SHIFT is 47, so we're comparing the 17-bit value (l.asBits >> JSVAL_TAG_SHIFT) to (0x1FFF0 | 0x07) << 47, which is hardly ever going to fail. I assume it was intended to compare the two 17-bit tag values (l.asBits >> JSVAL_TAG_SHIFT) and JSVAL_TAG_OBJECT.

(This assertion dates back to the initial landing of bug 549143.)

Comment 1

[Luke Wagner [:luke]]

Comment on attachment 8388164 [details] [diff] [review]
Patch v1

Hah, thanks.  Really, I should have introduced a new 
  #define JSVAL_MAX_TAG JSVAL_TAG_OBJECT
and then added
  JS_ASSERT(JSVAL_TAG_OBJECT == JSVAL_MAX_TAG)
in this function to make the representation dependency explicit.  Feel free to do that too, if you'd like.

Comment 2

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/281d420eb9b7

Comment 3

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/281d420eb9b7