621319 - TypeInference: JM: incorrect result for bitwise shift and eval

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

This test case:
---
function f() {
    var x = 0, y = 12.3, z = 0;
    eval("z = y << [1][0]");
    y = x;
    return z;
}
assertEq(f(), 24);
---
Fails with -m:

typein:7: Error: Assertion failed: got 858993460, expected 24

Comment 1

[Jesse Ruderman]

The first bad revision is:
changeset:   0cd7e38f0b39
user:        Brian Hackett
date:        Fri Oct 29 08:05:55 2010 -0700
summary:     [INFER] Javascript type inference, bug 557407.

Comment 2

[Paul Biggar]

I can't reproduce this on either JM tip or revision 0cd7e38f0b39. (We're in http://hg.mozilla.org/projects/jaegermonkey, right?)

Comment 3

[Jesse Ruderman]

When building from http://hg.mozilla.org/projects/jaegermonkey you probably want to build with --enable-type-inference.

Comment 4

[Jesse Ruderman]

WFM-ish.

The first good revision is:
changeset:   a2e6ee94f4bf
user:        Brian Hackett
date:        Mon Nov 01 09:43:25 2010 -0700
summary:     Kludge allowing JM to use type inference without needing recompilation, bug 608746.

Comment 5

[Brian Hackett [Laid off!]]

This looks fixed, doesn't reproduce with -m -n -a