465276 - TM: bizarre results for ((1 * (1)) | "")

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

e.js:

empty = [];
out = [];
for (var j=0;j<10;++j) { empty[42]; out.push((1 * (1)) | ""); }
print(uneval(out));

./js -j ~/e.js
[1, 1, 1965522873, 9, 16, 25, 36, 49, 64, 81]

Comment 1

[Jesse Ruderman]

Why do I need the "empty[42]" part?  That's an artifact of how the fuzzer works, rather than something the fuzzer generated :(

Comment 2

[Andreas Gal :gal]

Attachment: patch

Comment 3

[Andreas Gal :gal]

This is a super evil bug. We can't do CSE across in-trace branch labels. Will push with r=me until someone + or - it.

Comment 4

[Andreas Gal :gal]

http://hg.mozilla.org/tracemonkey/rev/55e30117ecee

Comment 5

[Andreas Gal :gal]

ccing ed and graydon

Comment 6

[Damon Sicore (:damons)]

reopening, marking blocking beta2, will close once landed on m-c.

Comment 7

[Mike Beltzner [:beltzner, not reading bugmail]]

Fixed in the merge pushed by vlad on Nov 18 14:11:14 2008 -0800:
http://hg.mozilla.org/mozilla-central/rev/e8ed5d4bf531

Comment 8

[Bob Clary [:bc] (inactive)]

Checking in js1_5/extensions/regress-465276.js;
/cvsroot/mozilla/js/tests/js1_5/extensions/regress-465276.js,v  <--  regress-465276.js
initial revision: 1.1

Comment 9

[Shawn Wilsher :sdwilsh]

http://hg.mozilla.org/mozilla-central/rev/7bed07c2b742

Comment 10

[Bob Clary [:bc] (inactive)]

v 1.9.1, 1.9.2