Closed Bug 640939 Opened 9 years ago Closed 9 years ago

TI+JM: incorrect result for bitwise operator after recompilation

Categories

(Core :: JavaScript Engine, defect)

defect
Not set

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Unassigned)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

200 bytes, application/x-javascript
Details
Attached file Test
Attached file fails with -m -n -a:
Error: Assertion failed: got 0, expected -920

I debugged this a bit in gdb. The "undefined" causes recompilation of g. The result of the first b << 1 is on the stack and prepareInferenceTypes converts this to a double. But the second b << 1 is compiled as if b is still an integer. 

Looks like there's a type mismatch for b after the first b << 1. Type inference says int-or-double -> double and JM thinks it's an int (result of bitwise op).
s/on the stack/stored to memory
Can't reproduce this anymore, I assume this fixed it:

http://hg.mozilla.org/projects/jaegermonkey/rev/7154281e487b
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → WORKSFORME
Resolution: WORKSFORME → FIXED
You need to log in before you can comment on or make changes to this bug.