611575 - TM: simple program gives wrong answer

Status: RESOLVED DUPLICATE of bug 596730

(Core :: JavaScript Engine, defect)

Description

[Nicholas Nethercote [inactive]]

I've reduced this to the following test case:

  function f(a) {
    print("pre-splice: " + a);
    while (a[0] in { 'x': 1 }) {
      a.splice(0, 1);
    }
    print("post-splice: " + a);
  };

  f(["x", "x", "y"]);
  f(["x", "x", "y"]);
  f(["x", "x", "y"]);
  f(["x", "x", "y"]);
  f(["x", "x", "y"]);

Running with -m I get the expected output:

  [ocean:~/moz/ws1/js/src/tmp] js1d32 -m parser.js
  pre-splice: x,x,y
  post-splice: y
  pre-splice: x,x,y
  post-splice: y
  pre-splice: x,x,y
  post-splice: y
  pre-splice: x,x,y
  post-splice: y
  pre-splice: x,x,y
  post-splice: y

(Copying this from 596730 comment 2.)

Running with -j the while loop finishes too early, as the last line printed
shows:

  [ocean:~/moz/ws1/js/src/tmp] js1d32 -j parser.js
  pre-splice: x,x,y
  post-splice: y
  pre-splice: x,x,y
  post-splice: y
  pre-splice: x,x,y
  post-splice: y
  pre-splice: x,x,y
  post-splice: y
  pre-splice: x,x,y
  post-splice: x,y

If you change just about anything in the program, the bug goes away.  This
includes removing the first print() call!

hg bisect blames the following changeset:

  The first bad revision is:
  changeset:   55739:0aa283c6294f
  user:        David Anderson <[e-mail]>
  date:        Fri Oct 22 16:27:28 2010 -0700
  summary:     Trace returning from JSOP_STOP with callDepth=0 (bug 606083,
r=billm).

Comment 1

[Nicholas Nethercote [inactive]]

(Apologies for the out-of-order paragraphs in comment 0.  Hopefully the gist is clear.)

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

That bisect result is suspicious; likely it caused something to trace where it would have aborted before. I'll take a look.

Comment 3

[Nicholas Nethercote [inactive]]

That's potentially good news:  it makes it more likely that there's a single defect causing both this bug and bug 596730.

Comment 4

[Nicholas Nethercote [inactive]]

(In reply to comment #3)
> That's potentially good news:  it makes it more likely that there's a single
> defect causing both this bug and bug 596730.

Turned out that is the case.  Marking this as a dup.