Closed
Bug 527288
Opened 15 years ago
Closed 15 years ago
TM: "Assertion failure: m != TT_INT32 || isInt32(*vp), at ../jstracer.cpp" with for, for...each
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
VERIFIED
FIXED
People
(Reporter: gkw, Assigned: n.nethercote)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-nanojit, fixed-in-tracemonkey)
Attachments
(1 file)
|
(deleted),
patch
|
edwsmith
:
review+
|
Details | Diff | Splinter Review |
(function () {
for (a = 0; a < 3; a++) {
for each(b in [0, -0]) {}
}
})()
asserts js debug shell with -j at Assertion failure: m != TT_INT32 || isInt32(*vp), at ../jstracer.cpp:3954
autoBisecting soon...
|
Reporter | |
Comment 1•15 years ago
|
||
autoBisect shows this is probably related to bug 502778:
The first bad revision is:
changeset: 34384:1f4284d6be93
user: Nicholas Nethercote
date: Thu Nov 05 09:40:33 2009 +1100
summary: Bug 502778 - nanojit: speed up CseFilter. r=edwsmith.
Blocks: 502778
|
|
Assignee | |
Comment 2•15 years ago
|
||
The CseFilter change wasn't supposed to change any functional behaviour, but it did -- it made it so that 0.0 and -0.0 would be CSE'd together, which is not what we want. The patch uses type-punning to convert the relevant doubles into uint64s for the comparison.
|
|
Assignee | |
Comment 3•15 years ago
|
||
BTW, the patch copies the test case from comment 0 into trace-tests/. I'm not sure if this is the right thing to do. CC'ing bclary.
|
||
Comment 4•15 years ago
|
||
Nick, seems ok to me. The js/src/trace-test/ stuff has a life of its own independent of the js/src/tests/.
|
||
Updated•15 years ago
|
Attachment #411122 -
Flags: review?(edwsmith) → review+
|
|
Assignee | |
Comment 5•15 years ago
|
||
The Nanojit part was landed thusly:
http://hg.mozilla.org/projects/nanojit-central/rev/8f59c1429621
The new TM test case will have to be landed separately.
Whiteboard: fixed-in-nanojit
|
|
Assignee | |
Comment 6•15 years ago
|
||
Merge from nanojit-central:
http://hg.mozilla.org/tracemonkey/rev/c9e5f4a7ca84
TM test case still requires landing separately.
|
|
Assignee | |
Comment 7•15 years ago
|
||
TM test case landed as:
http://hg.mozilla.org/tracemonkey/rev/484fb46ff8f2
Whiteboard: fixed-in-nanojit → fixed-in-nanojit, fixed-in-tracemonkey
|
|
||
Comment 8•15 years ago
|
||
Nick, thanks! Don't forget in-testsuite+ when you add a test! :-)
Flags: in-testsuite+
|
||
Comment 9•15 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
|
|
Reporter | |
Comment 10•12 years ago
|
||
A type of test for this bug has already been landed because it is already marked in-testsuite+ -> VERIFIED.
Status: RESOLVED → VERIFIED
You need to log in
before you can comment on or make changes to this bug.
Description
•