581936 - JM: Addition operator incorrectly coerces strings to integers

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Andrew Drake [:adrake]]

The following test case fails its assertion on every permutation of opt/debug 32/64 ic/noic (all with actual value 0):

function returnZero() { return 0; } 
function test() {
  var a = "a";
  var b = "b";
  if (returnZero()) {
    return a + b;
  } else {
    return b + a;
  }
}
assertEq(test(), "ba");

This bug was introduced by changeset http://hg.mozilla.org/users/danderson_mozilla.com/moo/rev/51ed7672df50 , [JAEGER] Simplify double arithmetic paths.

Comment 1

[Sean Stangl [:sstangl]]

It looks like a syncing problem.

When we go into the addition, the type registers are loaded -- the type of lhs and rhs are both identified as JSVAL_TAG_STRING, and the slow path is taken.

In the slow path, the rval is JSVAL_TAG_NULL, and the lval is JSVAL_TAG_INT32 with a payload of 0x0.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Great test-case, thanks! The bug is that when you construct your own OOL paths, syncExit assumes you called linkExit, so it can't be used. We were jumping right over the spill code.

http://hg.mozilla.org/users/danderson_mozilla.com/moo/rev/c31210b66d0c