Last Comment Bug 649769 - TI+JM: incorrect output with stricteq, inlining
: TI+JM: incorrect output with stricteq, inlining
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: general
:
Mentors:
Depends on:
Blocks: infer-regress
  Show dependency treegraph
 
Reported: 2011-04-13 12:57 PDT by Jan de Mooij [:jandem] (PTO until July 31)
Modified: 2011-04-13 15:22 PDT (History)
5 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Testcase (178 bytes, application/x-javascript)
2011-04-13 12:57 PDT, Jan de Mooij [:jandem] (PTO until July 31)
no flags Details

Description Jan de Mooij [:jandem] (PTO until July 31) 2011-04-13 12:57:20 PDT
Created attachment 525774 [details]
Testcase

$ ./js -n -a -m test.js
false
true <- should be false

Revision a3eeee8f7803, 32-bit.
Comment 1 Brian Hackett (:bhackett) 2011-04-13 15:22:36 PDT
Pretty tricky call path bug.  If we rejoin after a recompilation in the middle of the call path, i.e. after the entry code has been generated and before it has been jumped to, the new frame has been pushed but the rejoin code assumes it still points to the old frame.  We then start patching random things into doubles.  This changes things so that ic::Call, stubs::UncachedCall etc. do not change regs->fp but store the new fp in regs->sp.  This is then reloaded after doing all necessary patching of the calling frame.

http://hg.mozilla.org/projects/jaegermonkey/rev/affaa35f4a14

Note You need to log in before you can comment on or make changes to this bug.