502147 - With jit.content = true, running arithmetic generates incorrect results

Status: RESOLVED DUPLICATE of bug 501124

(Core :: JavaScript Engine, defect)

Description

[Scott Shumaker]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.11) Gecko/2009060214 Firefox/3.0.11
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1) Gecko/20090624 Firefox/3.5 (.NET CLR 3.5.30729)

Example code:

    crc32 = function( /* String */ str, /* Number */ crc ) { 
        if( crc == window.undefined ) crc = 0; 
        var n = 0; //a number between 0 and 255 
        var x = 0; //an hex number 
 
        crc = crc ^ (-1); 
        for( var i = 0, iTop = str.length; i < iTop; i++ ) { 
            n = ( crc ^ str.charCodeAt( i ) ) & 0xFF; 
            x = "0x" + table.substr( n * 9, 8 ); 
            crc = ( crc >>> 8 ) ^ x; 
        } 
        return crc ^ (-1); 
    }; 


This function generates the incorrect result with jit.content true.  For example, try calling it with crc32("96d30d10_32e9_012c_f7d9_12313a00c65212").




Reproducible: Always

Steps to Reproduce:
1. Load the above function
2. run: crc32("96d30d10_32e9_012c_f7d9_12313a00c65212")

Actual Results:  
returns -1

Expected Results:  
It should return 862654302

If you add additional tracing code (console.logs) to the crc32 function, it returns the correct result - probably because it is messing with the jit optimization process.

Comment 1

[Andreas Gal :gal]

The test case is incomplete, but this is clearly a dup of 501124. A fix is already approved for 3.5.1

Comment 2

[Andreas Gal :gal]

Reporter: the fix is available in the TM hourly builds (not anywhere else, sorry) if you want to try it.