TM: simple program gives wrong answer

RESOLVED DUPLICATE of bug 596730

Status

()

Core
JavaScript Engine
RESOLVED DUPLICATE of bug 596730
7 years ago
7 years ago

People

(Reporter: njn, Assigned: dvander)

Tracking

({regression})

unspecified
x86
Mac OS X
regression
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(blocking2.0 final+)

Details

(Reporter)

Description

7 years ago
I've reduced this to the following test case:

  function f(a) {
    print("pre-splice: " + a);
    while (a[0] in { 'x': 1 }) {
      a.splice(0, 1);
    }
    print("post-splice: " + a);
  };

  f(["x", "x", "y"]);
  f(["x", "x", "y"]);
  f(["x", "x", "y"]);
  f(["x", "x", "y"]);
  f(["x", "x", "y"]);

Running with -m I get the expected output:

  [ocean:~/moz/ws1/js/src/tmp] js1d32 -m parser.js
  pre-splice: x,x,y
  post-splice: y
  pre-splice: x,x,y
  post-splice: y
  pre-splice: x,x,y
  post-splice: y
  pre-splice: x,x,y
  post-splice: y
  pre-splice: x,x,y
  post-splice: y

(Copying this from 596730 comment 2.)

Running with -j the while loop finishes too early, as the last line printed
shows:

  [ocean:~/moz/ws1/js/src/tmp] js1d32 -j parser.js
  pre-splice: x,x,y
  post-splice: y
  pre-splice: x,x,y
  post-splice: y
  pre-splice: x,x,y
  post-splice: y
  pre-splice: x,x,y
  post-splice: y
  pre-splice: x,x,y
  post-splice: x,y

If you change just about anything in the program, the bug goes away.  This
includes removing the first print() call!

hg bisect blames the following changeset:

  The first bad revision is:
  changeset:   55739:0aa283c6294f
  user:        David Anderson <danderson@mozilla.com>
  date:        Fri Oct 22 16:27:28 2010 -0700
  summary:     Trace returning from JSOP_STOP with callDepth=0 (bug 606083,
r=billm).
(Reporter)

Updated

7 years ago
Blocks: 596730
(Reporter)

Updated

7 years ago
Blocks: 606083
(Reporter)

Comment 1

7 years ago
(Apologies for the out-of-order paragraphs in comment 0.  Hopefully the gist is clear.)
blocking2.0: --- → ?
Keywords: regression
(Assignee)

Comment 2

7 years ago
That bisect result is suspicious; likely it caused something to trace where it would have aborted before. I'll take a look.
Assignee: general → dvander
Status: NEW → ASSIGNED
blocking2.0: ? → final+
(Reporter)

Comment 3

7 years ago
That's potentially good news:  it makes it more likely that there's a single defect causing both this bug and bug 596730.
(Reporter)

Comment 4

7 years ago
(In reply to comment #3)
> That's potentially good news:  it makes it more likely that there's a single
> defect causing both this bug and bug 596730.

Turned out that is the case.  Marking this as a dup.
Status: ASSIGNED → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 596730
You need to log in before you can comment on or make changes to this bug.