740970 - JavaScript expression with "||" evaluated incorrectly

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Felix Klein]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

Steps to reproduce:

I created a JavaScript application that includes the following code:
var a = (x + (vx < 0 ? vx : 0) >= other.pos.x + other.size.x );
var b = (x + this.size.x + (vx > 0 ? vx : 0) <= other.pos.x );
var c = ( y + (vy < 0 ? vy : 0) >= other.pos.y + other.size.y);
var d = (y + this.size.y + (vy > 0 ? vy : 0) <= other.pos.y);
ig.log("x:" + x  + " y: " + y + " vx: " + vx + " vy: " + vy +
            " this.size.x: " + this.size.x + " this.size.y: " + this.size.y +
            " other.pos.x " + other.pos.x + " other.pos.y "  + other.pos.y +
            " other.size.x " + other.size.x + " other.size.y: " + other.size.y );
ig.log("PASS1: " +
            a + " || " + b + " || " +  c + " || " + d + " = " + (a || b || c || d )
            );
ig.log("PASS2: " +
            (x + (vx < 0 ? vx : 0) >= other.pos.x + other.size.x ) + " || " +
            (x + this.size.x + (vx > 0 ? vx : 0) <= other.pos.x ) + " || " +
            ( y + (vy < 0 ? vy : 0) >= other.pos.y + other.size.y) + " || " +
            (y + this.size.y + (vy > 0 ? vy : 0) <= other.pos.y) + " = " +
            (
            (x + (vx < 0 ? vx : 0) >= other.pos.x + other.size.x ) ||
            (x + this.size.x + (vx > 0 ? vx : 0) <= other.pos.x ) ||
            ( y + (vy < 0 ? vy : 0) >= other.pos.y + other.size.y) ||
            (y + this.size.y + (vy > 0 ? vy : 0) <= other.pos.y)
            )
        );

// NOTE#1: ig.log outputs the string into the console



Actual results:

The following output:

x:308 y: 290.22 vx: 0 vy: -3.0600000000000627 this.size.x: 24 this.size.y: 24 other.pos.x 312 other.pos.y 272 other.size.x 16 other.size.y: 16 

PASS1: false || false || false || false = false 

PASS2: false || false || false || false = true


Expected results:

The following output:

x:308 y: 290.22 vx: 0 vy: -3.0600000000000627 this.size.x: 24 this.size.y: 24 other.pos.x 312 other.pos.y 272 other.size.x 16 other.size.y: 16 

PASS1: false || false || false || false = false 

PASS2: false || false || false || false = false // THE RESULT SHOULD BE FALSE HERE

Comment 1

[Felix Klein]

Some more infos:
- In short: The boolean expression with || is not evaluated correctly
- This code fragment is part of a game engine (a modifed version of impact.js)
- This bug is reproducible - but it happens inside a game engine which comes with a lot of code
- This bug only happens, when Firebug is switched off. Everytime Firebug is switched on, the bug disappears. When switched off again, it occurs again. Webpage doesn't need to be reloaded or anything
- when using '+' instead of '||' the expression is evaluated correctly

About my browser version: I actually submitted this bug from Chrome. 
This bug occurred in Firefox 11.0.

I'll find a simpler piece of code that can reproduce the problem (hopefully)

Comment 2

[Felix Klein]

Sorry, I can't reproduce the problem out of context. The following code works correctly:
	<script type="text/javascript" >
        var x = 308, y = 290.22,  vx = 0, vy = -3.0600000000000627;
        this.size = {x : 24, y : 24};
        var other = { pos : {x: 312, y: 272}, size: {x: 16, y: 16}};
    
        var a = (x + (vx < 0 ? vx : 0) >= other.pos.x + other.size.x );
        var b = (x + this.size.x + (vx > 0 ? vx : 0) <= other.pos.x );
        var c = ( y + (vy < 0 ? vy : 0) >= other.pos.y + other.size.y);
        var d = (y + this.size.y + (vy > 0 ? vy : 0) <= other.pos.y);
        document.write("x:" + x  + " y: " + y + " vx: " + vx + " vy: " + vy +
            " this.size.x: " + this.size.x + " this.size.y: " + this.size.y +
            " other.pos.x " + other.pos.x + " other.pos.y "  + other.pos.y +
            " other.size.x " + other.size.x + " other.size.y: " + other.size.y );
        document.write("<br />")
        document.write("PASS1: " +
            a + " || " + b + " || " +  c + " || " + d + " = " + (a || b || c || d )
            );
        document.write("<br />")

        document.write("PASS2: " +
            (x + (vx < 0 ? vx : 0) >= other.pos.x + other.size.x ) + " || " +
            (x + this.size.x + (vx > 0 ? vx : 0) <= other.pos.x ) + " || " +
            ( y + (vy < 0 ? vy : 0) >= other.pos.y + other.size.y) + " || " +
            (y + this.size.y + (vy > 0 ? vy : 0) <= other.pos.y) + " = " +
            (
            (x + (vx < 0 ? vx : 0) >= other.pos.x + other.size.x ) ||
            (x + this.size.x + (vx > 0 ? vx : 0) <= other.pos.x ) ||
            ( y + (vy < 0 ? vy : 0) >= other.pos.y + other.size.y) ||
            (y + this.size.y + (vy > 0 ? vy : 0) <= other.pos.y)
            )
        );
    
    </script>
Output:
x:308 y: 290.22 vx: 0 vy: -3.0600000000000627 this.size.x: 24 this.size.y: 24 other.pos.x 312 other.pos.y 272 other.size.x 16 other.size.y: 16
PASS1: false || false || false || false = false
PASS2: false || false || false || false = false 

If everything else fails, I'll provide access to the web application (as I said, the problem is perfectly reproducible there...)

Comment 3

[Tom S [:evilpie]]

Can you still reproduce this?

Comment 4

[Felix Klein]

Hm, unfortunately (or fortunately?) not anymore.
I just updates Firefox and tried to reproduce the problem, but everything worked fine.
So, hopefully the problem was fixed sometime, somehow.