587964 - TM: out-of-bounds string index returns empty string

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

There is one difference between JM/TM on the Sputnik tests, RegExp-test S15.10.2.10_A5.1_T1.js. I asked cdleary about it, but it's not related to YARR. The test case can be reduced to:

var s = "12345";
for(var i=0; i<7; i++) {
    print(s[i].length);
}

./js output (also ./js -m on JM-branch):
1
1
1
1
/home/jan/test.js:4: TypeError: s[i] is undefined

./js -j output:
1
1
1
1
0

Comment 1

[Jan de Mooij [:jandem]]

The output I posted is wrong -- there should be an extra 1 and an extra 0. I think the problem is clear though.

Comment 2

[Jan de Mooij [:jandem]]

set blocking-2.0 flag, as this may break some websites.

Comment 3

[Jan de Mooij [:jandem]]

Probably caused by patch for bug 584499.

Comment 5

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Comment 7

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/tracemonkey/rev/71e7048001c9

Comment 8

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/71e7048001c9