647524 - TI: Different output with testcase with and without -j

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd]]

for (let y in [0, Boolean, Boolean, Boolean, Boolean, Boolean, 0, Boolean()]) {
    print(["2" for (y in [, ])])
}

outputs a "2" in standard output when JM opt shell is run with -j. JM shell without -j, TM changeset 508ced87a3f8 shell with and without -j does not have "2" in stdout.

Tested on JM changeset c340841f0465.

Comment 1

[Gary Kwong [:gkw] [:nth10sd]]

Attachment: not-so-useful regression window

The potential regression window seems large, nonetheless it seems to have been around since early-March..

Comment 2

[Brian Hackett [Laid off!]]

There was an optimization to EnsureDenseArrayCapacity done for the packed array stuff (several months old) that could incorrectly overwrite an array hole while processing array initializers containing holes.  This change is pointless now given the improved handling of packed arrays when running without -n, this fix reverts this code to how it looks in the TM branch.

http://hg.mozilla.org/projects/jaegermonkey/rev/11f4754d8282