Closed Bug 502768 Opened 15 years ago Closed 15 years ago

Incorrect number with ^ (int-double confusion?)

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: jruderman, Unassigned)

References

Details

(Keywords: testcase) 

var a = 0;
var i = 0;
for each (let e in ['', 0, {}, '', '' ,'']) {
    a ^= 0;
    if (i == 1) {
        a = 0x80000001;
    }
    for each (let r in [.5, .5]) { }
    ++i;
}
print(a);

Without JIT: -2147483647
With JIT:    -4194304

Thanks to Gary for finding and partially reducing.
Jesse, this looks fixed with the patch in bug 502604. Can you confirm?
Just as I was complaining about fuzzer not hitting it ... great job jesse & gary.
Yep, the patch in bug 502604 fixes this.
(In reply to comment #3)
> Yep, the patch in bug 502604 fixes this.

Confirming fixed by bug 502604.
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.