JIT compilation of javascript breaks sparse arrays

RESOLVED WORKSFORME

Status

()

RESOLVED WORKSFORME
10 years ago
10 years ago

People

(Reporter: duncan.loveday, Unassigned)

Tracking

({testcase})

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

10 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080929032103 Minefield/3.1b1pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080929032103 Minefield/3.1b1pre

The attached demonstrates an issue with sparse arrays having 32 or more missing elements at the front of the array. The correct result is not returned when joining the array when the JIT preferences are enabled.

Reproducible: Always

Steps to Reproduce:
1. Go to about:config and enable the prefs javascript.options.jit.*
2. Load the attached and press "Go"
3.
Actual Results:  
I see an alert message "Yundefinedundefinedundefinedundefined"

Expected Results:  
The expected result is "YYYYY"

If you change the test case so that the starting index is 31 or lower, or if you turn off the JIT prefs, the problem goes away.
(Reporter)

Comment 1

10 years ago
Created attachment 341081 [details]
Test case
(Reporter)

Updated

10 years ago
Keywords: testcase
(Reporter)

Comment 2

10 years ago
I can reproduce this bug on

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080929032103 Minefield/3.1b1pre

but not on either of

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080930093007 Minefield/3.1b1pre
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080929033431 Minefield/3.1b1pre

Updated

10 years ago
Status: UNCONFIRMED → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.