Closed Bug 647524 Opened 9 years ago Closed 9 years ago

TI: Different output with testcase with and without -j

Categories

(Core :: JavaScript Engine, defect)

defect
Not set

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

(Blocks 3 open bugs)

Details

(Keywords: regression, testcase)

Attachments

(1 file)

for (let y in [0, Boolean, Boolean, Boolean, Boolean, Boolean, 0, Boolean()]) {
    print(["2" for (y in [, ])])
}

outputs a "2" in standard output when JM opt shell is run with -j. JM shell without -j, TM changeset 508ced87a3f8 shell with and without -j does not have "2" in stdout.

Tested on JM changeset c340841f0465.
The potential regression window seems large, nonetheless it seems to have been around since early-March..
OS: Mac OS X → All
Hardware: x86 → All
There was an optimization to EnsureDenseArrayCapacity done for the packed array stuff (several months old) that could incorrectly overwrite an array hole while processing array initializers containing holes.  This change is pointless now given the improved handling of packed arrays when running without -n, this fix reverts this code to how it looks in the TM branch.

http://hg.mozilla.org/projects/jaegermonkey/rev/11f4754d8282
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Blocks: 349611
You need to log in before you can comment on or make changes to this bug.