TypeInference: different result in JM and interpreter

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
7 years ago
7 years ago

People

(Reporter: jandem, Assigned: bhackett)

Tracking

(Blocks: 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-jaegermonkey)

Attachments

(1 attachment)

(Reporter)

Description

7 years ago
----
function f() {
    var x = NaN;
    if (2 > 0) {}
    var y = {};
    var z = (1234 - x);
    y.foo = z;
    print(z);
}
f();
----
./js -m: 1.060738863e-314
./js: NaN
(Assignee)

Comment 1

7 years ago
Created attachment 496154 [details] [diff] [review]
fix

Nice catch!  When breaking an FP register into two normal registers (nasty thing for ICs which will go away eventually), we could clobber the FP register even if it still in use.

http://hg.mozilla.org/projects/jaegermonkey/rev/4d0b24613dd8
Assignee: general → bhackett1024
(Assignee)

Updated

7 years ago
Whiteboard: fixed-in-jaegermonkey
Blocks: 619415
No longer blocks: 608741
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.