457835 - JIT compilation of javascript breaks sparse arrays

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Duncan Loveday]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080929032103 Minefield/3.1b1pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080929032103 Minefield/3.1b1pre

The attached demonstrates an issue with sparse arrays having 32 or more missing elements at the front of the array. The correct result is not returned when joining the array when the JIT preferences are enabled.

Reproducible: Always

Steps to Reproduce:
1. Go to about:config and enable the prefs javascript.options.jit.*
2. Load the attached and press "Go"
3.
Actual Results:  
I see an alert message "Yundefinedundefinedundefinedundefined"

Expected Results:  
The expected result is "YYYYY"

If you change the test case so that the starting index is 31 or lower, or if you turn off the JIT prefs, the problem goes away.

Comment 1

[Duncan Loveday]

Attachment: Test case

Comment 2

[Duncan Loveday]

I can reproduce this bug on

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080929032103 Minefield/3.1b1pre

but not on either of

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080930093007 Minefield/3.1b1pre
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080929033431 Minefield/3.1b1pre