640939 - TI+JM: incorrect result for bitwise operator after recompilation

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

Attachment: Test

Attached file fails with -m -n -a:
Error: Assertion failed: got 0, expected -920

I debugged this a bit in gdb. The "undefined" causes recompilation of g. The result of the first b << 1 is on the stack and prepareInferenceTypes converts this to a double. But the second b << 1 is compiled as if b is still an integer. 

Looks like there's a type mismatch for b after the first b << 1. Type inference says int-or-double -> double and JM thinks it's an int (result of bitwise op).

Comment 1

[Jan de Mooij [:jandem]]

s/on the stack/stored to memory

Comment 2

[Jan de Mooij [:jandem]]

Can't reproduce this anymore, I assume this fixed it:

http://hg.mozilla.org/projects/jaegermonkey/rev/7154281e487b