Bug 1526840 Comment 7 Edit History

Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.

Original comment by
on 
Actually this one isn't related to inc/dec :/  the bigint in this case is just stored in an array.  Still investigating.  I still think it's not security-sensitive though as you need the bigint to hit it.

The bug doesn't show up if inlining is off, with the test above.  But it does if I manually inline.  Here's a further reduced test case:

```js
for (let j = 0; j < 2; ++j) {
    for (let k = 0; k < 2; ++k) {
        let z = j ? 0n : 1;
        if (z) {
            z = 0;
        } else {
            z = 0;
        }
    }
}
```

Run as --no-threads --ion-eager.
Revision 1 by
on 
Actually this one isn't related to inc/dec :/  the bigint in this case is just stored in an array.  Still investigating.  I still think it's not security-sensitive though as you need the bigint to hit it.

The bug doesn't show up if inlining is off, with the test above.  But it does if I manually inline.  Here's a further reduced test case:

```js
for (let j = 0; j < 2; ++j) {
    let z = j ? 0n : 1;
    if (z) {
        z = 0;
    } else {
        z = 0;
    }
}
```

Run as --no-threads --ion-eager.

Back to Bug 1526840 Comment 7