Closed Bug 510434 Opened 13 years ago Closed 12 years ago

TM: incorrect value when printing "arguments"

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
normal

Tracking

()

VERIFIED FIXED
Tracking Status
status1.9.2 --- beta1-fixed

People

(Reporter: jruderman, Assigned: dmandelin)

Details

(Keywords: testcase, verified1.9.2, Whiteboard: [sg:critical?] fixed-in-tracemonkey)

Attachments

(1 file)

(function(){ var arguments = 3; for (var j=0;j<4;++j) print(arguments); } )()

3
3
3
6.3669234573e-314

(First JIT correctness bug found by jsfunfuzz!)
Attached patch PatchSplinter Review
Assignee: general → dmandelin
Status: NEW → ASSIGNED
Attachment #394610 - Flags: review?
Attachment #394610 - Flags: review? → review+
Whiteboard: [sg:critical?]
Pushed to TM as 750e909e4433.
Whiteboard: [sg:critical?] → [sg:critical?] fixed-in-tracemonkey
(Why is this "sg:critical?"  And was this seen on m-c or only in tracemonkey?  Just trying to figure out how to read the recent surge in JS sg:crit(?) count.)
When I see the JS engine treat a non-double as a double, I think it's likely that worse things could happen due to the same bug.  See bug 489682, for example.
http://hg.mozilla.org/mozilla-central/rev/750e909e4433
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
js/src/trace-test/tests/basic/bug510434.js
Flags: in-testsuite+
v 1.9.3, 1.9.2
Status: RESOLVED → VERIFIED
Keywords: verified1.9.2
Group: core-security
You need to log in before you can comment on or make changes to this bug.