617460 - TypeInference: different result in JM and interpreter

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

----
function f() {
    var x = NaN;
    if (2 > 0) {}
    var y = {};
    var z = (1234 - x);
    y.foo = z;
    print(z);
}
f();
----
./js -m: 1.060738863e-314
./js: NaN

Comment 1

[Brian Hackett [Laid off!]]

Attachment: fix

Nice catch!  When breaking an FP register into two normal registers (nasty thing for ICs which will go away eventually), we could clobber the FP register even if it still in use.

http://hg.mozilla.org/projects/jaegermonkey/rev/4d0b24613dd8