Closed Bug 621512 Opened 15 years ago Closed 15 years ago

JM: jsop_length should use urshift32 instead of rshiftPtr

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
normal

Tracking

()

RESOLVED FIXED
Tracking Status
blocking2.0 --- betaN+

People

(Reporter: jandem, Assigned: jandem)

References

Details

(Keywords: regression, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

Consider this test case: --- function f() { var s1 = Array(15000).join('-'); var s2 = Array(9000).join(s1); s2 = "" + s2; assertEq(s2.length, 134976001); } f(); --- This fails in JM: test.js:6: Error: Assertion failed: got -133459455, expected 134976001 The problem is that mjit::Compiler::jsop_length uses rshiftPtr instead of urshift32.
Summary: JM: wrong result for jsop_length → JM: jsop_length should use urshift32 instead of rshiftPtr
Attached patch FixSplinter Review
This uses urshift32 like we do in generateStringLengthStub (PolyIC.cpp). I did not add the test case because it uses a lot of memory...
Attachment #499825 - Flags: review?(sstangl)
Keywords: regression
blocking2.0: --- → betaN+
Comment on attachment 499825 [details] [diff] [review] Fix Great find.
Attachment #499825 - Flags: review?(sstangl) → review+
Keywords: checkin-needed
Anybody willing to land this patch? It's a one line change and really safe.
Status: ASSIGNED → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: