Closed Bug 456479 Opened 11 years ago Closed 11 years ago

TM: correctness bug with undefined turning into NaN

Categories

(Core :: JavaScript Engine, defect, P1)

defect

Tracking

()

VERIFIED FIXED
mozilla1.9.1b2

People

(Reporter: dvander, Assigned: dvander)

References

Details

(Keywords: verified1.9.1)

Attachments

(1 file)

Attached file breaking case
In the fourth run of this loop we have a tree compiled for doubles.  undefined gets changed to a NaN and the val is undefined and gets changed to a NaN as well.

NaNs do not compare so a[i] is false with the JIT on, but true with the interpreter (since it is not using doubles).
Depends on: 456588
Oops, does not depend on bug 456588, since this bug is about missing arguments. This is the t/3d-raytrace.js problem too, though -- bug 454315.

/be
Blocks: 454315
No longer depends on: 456588
Assignee: general → danderson
Flags: blocking1.9.1?
OS: Mac OS X → All
Hardware: PC → All
Target Milestone: --- → mozilla1.9.1
Flags: blocking1.9.1? → blocking1.9.1+
Priority: -- → P1
Target Milestone: mozilla1.9.1 → mozilla1.9.1b2
Fixed now that multitrees has landed.

Pushed test case as changeset: http://hg.mozilla.org/tracemonkey/rev/e33ca6afff2a
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
please set back to RESOLVED FIXED after landing in mozilla-central.  Thanks.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Already landed in mozilla-central.
Status: REOPENED → RESOLVED
Closed: 11 years ago11 years ago
Resolution: --- → FIXED
thanks david.  what's the easiest way i can tell that is has in the bug?  from what i read here, it isnt obvious to me unless i actually had a chance to open up the fix on the trunk.
Hrm, I don't think there's no easy way other than looking at when tm was last pushed to m-c.  From the m-c changelog:

e36b9418613b
2008-11-16 02:44 -0500	Robert Sayre - Merge m-c to tracemonkey.

So anything before that date has landed.
test already in js1_8_1/trace/trace-test.js
Flags: in-testsuite+
Flags: in-litmus-
v 1.9.1, 1.9.2
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.