621512 - JM: jsop_length should use urshift32 instead of rshiftPtr

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

Consider this test case:
---
function f() {
    var s1 = Array(15000).join('-');
    var s2 = Array(9000).join(s1);
    s2 = "" + s2;
    assertEq(s2.length, 134976001);
}
f();
---
This fails in JM:
test.js:6: Error: Assertion failed: got -133459455, expected 134976001

The problem is that mjit::Compiler::jsop_length uses rshiftPtr instead of urshift32.

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Fix

This uses urshift32 like we do in generateStringLengthStub (PolyIC.cpp). I did not add the test case because it uses a lot of memory...

Comment 2

[Sean Stangl [:sstangl]]

Comment on attachment 499825 [details] [diff] [review]
Fix

Great find.

Comment 3

[Jan de Mooij [:jandem]]

Anybody willing to land this patch? It's a one line change and really safe.

Comment 4

[Brendan Eich [:brendan]]

http://hg.mozilla.org/tracemonkey/rev/96482f2ef48e

/be

Comment 5

[Chris Leary [:cdleary] (not checking bugmail)]

http://hg.mozilla.org/mozilla-central/rev/96482f2ef48e