503488 - TM: Different invalid instanceof operand values with JIT off/on

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect, P2)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

v = 0;
for each(c in [0, [''], 0, ['']]) {
    if (++v > 3) {
        c instanceof(v = c)
    }
}

TM branch tip.

=====

$ ~/Desktop/tm-30032-c8489ee35bb2/js-dbg-tm-intelmac 
js> v = 0;
0
js> for each(c in [0, [''], 0, ['']]) {
    if (++v > 3) {
        c instanceof(v = c)
    }
}
typein:4: TypeError: invalid 'instanceof' operand v
js> 

$ ~/Desktop/tm-30032-c8489ee35bb2/js-dbg-tm-intelmac -j
js> v = 0;
0
js> for each(c in [0, [''], 0, ['']]) {
    if (++v > 3) {
        c instanceof(v = c)
    }
}
typein:4: TypeError: invalid 'instanceof' operand [""]
js>

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(Not exactly the smallest) regression window:

http://hg.mozilla.org/tracemonkey/rev/fb64ba1cb3ad - outputs identical TypeError.
http://hg.mozilla.org/tracemonkey/rev/a36145aabfa9 - outputs different TypeError.

Comment 2

[Damon Sicore (:damons)]

Gal is going to re-test.

Comment 3

[Andreas Gal :gal]

Steps to do:

test on 1.9.1 and 1.9.2 to make sure its WFM there too and then close the bug

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

This WFM on trunk and 1.9.2.