465133 - TM: JIT affects object inequality

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

js> for(i=0;i<5;++i) print("" + ({} < {}));
false
false
true
true
true

Comment 1

[Brendan Eich [:brendan]]

No imacros here, this is a straight-up bug in TraceRecorder::cmp.

/be

Comment 2

[Andreas Gal :gal]

Attachment: patch

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 348398 [details] [diff] [review]
patch

Breaks this kind of test:

js> var o={}, a=[]
js> for(var i=0;i<5;i++) a[i]=(o<=o);
true
js> uneval(a)
[true, true, true, true, true]

/be

Comment 4

[Andreas Gal :gal]

Attachment: v2, with imacro magic

Comment 5

[Brendan Eich [:brendan]]

Comment on attachment 348405 [details] [diff] [review]
v2, with imacro magic


>@@ -4482,18 +4528,17 @@ TraceRecorder::cmp(LOpcode op, int flags
>         // the right thing.
>         cond = evalCmp(op, l, r);
>         // For ==, !=, ===, and !=== the result is magically correct even if undefined (2) is
>         // involved. For the relational operations we need some additional cmov magic to make
>         // the result always false (since undefined becomes NaN per ECMA and that doesn't
>         // compare to anything, even itself). The code for this is emitted a few lines down.
>     } else if (JSVAL_IS_OBJECT(l) && JSVAL_IS_OBJECT(r)) {
>         if (op != LIR_feq) {
>-            negate = !(op == LIR_fle || op == LIR_fge);
>-            op = LIR_feq;
>+            JS_NOT_REACHED("we should have converted to numbers already");
>         }

Single-line then doesn't need braces -- but we really should return false after JS_NOT_REACHED, since it compiles to nothing on NDEBUG builds. r=me with that fix.

/be

Comment 6

[Andreas Gal :gal]

Fixed on TM.

http://hg.mozilla.org/tracemonkey/rev/0cda5f044adb

Comment 7

[Bob Clary [:bc] (inactive)]

test already in js1_8_1/trace/trace-test.js

Comment 8

[Bob Clary [:bc] (inactive)]

added test http://hg.mozilla.org/mozilla-central/rev/6c0e7c9e595c and cvs.

Comment 9

[Bob Clary [:bc] (inactive)]

v 1.9.1, 1.9.2