Bug 618577 - TM: "Assertion failure: 0,". r=vlad.

This commit is contained in:
Nicholas Nethercote 2010-12-14 13:41:41 -08:00
parent 496d23894b
commit 2993a9524d
2 changed files with 12 additions and 6 deletions

View File

@ -0,0 +1,5 @@
var x = Uint32Array();
for (var i = 0; i < 100; i++)
x[77] = x[77];
// Don't assert.

View File

@ -4298,7 +4298,7 @@ TraceRecorder::guard(bool expected, LIns* cond, VMSideExit* exit,
RETURN_STOP("Constantly false guard detected");
}
/*
* If this assertion fails, first decide if you want recording to
* If you hit this assertion, first decide if you want recording to
* abort in the case where the guard always exits. If not, find a way
* to detect that case and avoid calling guard(). Otherwise, change
* the invocation of guard() so it passes in abortIfAlwaysExits=true,
@ -4307,7 +4307,7 @@ TraceRecorder::guard(bool expected, LIns* cond, VMSideExit* exit,
* insGuard() below and an always-exits guard will be inserted, which
* is correct but sub-optimal.)
*/
JS_ASSERT(0);
JS_NOT_REACHED("unexpected constantly false guard detected");
}
/*
@ -12793,9 +12793,10 @@ TraceRecorder::setElem(int lval_spindex, int idx_spindex, int v_spindex)
CHECK_STATUS_A(makeNumberInt32(idx_ins, &idx_ins));
// Ensure idx >= 0 && idx < length (by using uint32)
guard(true,
w.ltui(idx_ins, w.ldiConstTypedArrayLength(priv_ins)),
OVERFLOW_EXIT);
CHECK_STATUS_A(guard(true,
w.name(w.ltui(idx_ins, w.ldiConstTypedArrayLength(priv_ins)),
"inRange"),
OVERFLOW_EXIT, /* abortIfAlwaysExits = */true));
// We're now ready to store
LIns* data_ins = w.ldpConstTypedArrayData(priv_ins);
@ -13847,7 +13848,7 @@ TraceRecorder::typedArrayElement(Value& oval, Value& ival, Value*& vp, LIns*& v_
* length.
*/
guard(true,
w.ltui(idx_ins, w.ldiConstTypedArrayLength(priv_ins)),
w.name(w.ltui(idx_ins, w.ldiConstTypedArrayLength(priv_ins)), "inRange"),
BRANCH_EXIT);
/* We are now ready to load. Do a different type of load