Closed Bug 617460 Opened 10 years ago Closed 10 years ago

TypeInference: different result in JM and interpreter

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Assigned: bhackett1024)

References

(Blocks 1 open bug)

Details

(Whiteboard: fixed-in-jaegermonkey)

Attachments

(1 file)

----
function f() {
    var x = NaN;
    if (2 > 0) {}
    var y = {};
    var z = (1234 - x);
    y.foo = z;
    print(z);
}
f();
----
./js -m: 1.060738863e-314
./js: NaN
Attached patch fixSplinter Review
Nice catch!  When breaking an FP register into two normal registers (nasty thing for ICs which will go away eventually), we could clobber the FP register even if it still in use.

http://hg.mozilla.org/projects/jaegermonkey/rev/4d0b24613dd8
Assignee: general → bhackett1024
Whiteboard: fixed-in-jaegermonkey
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.