JM: jsop_length should use urshift32 instead of rshiftPtr

RESOLVED FIXED

Status

()

RESOLVED FIXED
8 years ago
8 years ago

People

(Reporter: jandem, Assigned: jandem)

Tracking

({regression})

unspecified
x86
Mac OS X
regression
Points:
---

Firefox Tracking Flags

(blocking2.0 betaN+)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 attachment)

(Assignee)

Description

8 years ago
Consider this test case:
---
function f() {
    var s1 = Array(15000).join('-');
    var s2 = Array(9000).join(s1);
    s2 = "" + s2;
    assertEq(s2.length, 134976001);
}
f();
---
This fails in JM:
test.js:6: Error: Assertion failed: got -133459455, expected 134976001

The problem is that mjit::Compiler::jsop_length uses rshiftPtr instead of urshift32.
(Assignee)

Updated

8 years ago
Summary: JM: wrong result for jsop_length → JM: jsop_length should use urshift32 instead of rshiftPtr
(Assignee)

Comment 1

8 years ago
Created attachment 499825 [details] [diff] [review]
Fix

This uses urshift32 like we do in generateStringLengthStub (PolyIC.cpp). I did not add the test case because it uses a lot of memory...
Attachment #499825 - Flags: review?(sstangl)
(Assignee)

Updated

8 years ago
Keywords: regression
blocking2.0: --- → betaN+
Comment on attachment 499825 [details] [diff] [review]
Fix

Great find.
Attachment #499825 - Flags: review?(sstangl) → review+
(Assignee)

Updated

8 years ago
Keywords: checkin-needed
(Assignee)

Comment 3

8 years ago
Anybody willing to land this patch? It's a one line change and really safe.
http://hg.mozilla.org/tracemonkey/rev/96482f2ef48e

/be
Whiteboard: fixed-in-tracemonkey
Keywords: checkin-needed
http://hg.mozilla.org/mozilla-central/rev/96482f2ef48e
Status: ASSIGNED → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.