Closed Bug 649769 Opened 9 years ago Closed 9 years ago

TI+JM: incorrect output with stricteq, inlining

Categories

(Core :: JavaScript Engine, defect)

defect
Not set

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Unassigned)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

178 bytes, application/x-javascript
Details
Attached file Testcase
$ ./js -n -a -m test.js
false
true <- should be false

Revision a3eeee8f7803, 32-bit.
Pretty tricky call path bug.  If we rejoin after a recompilation in the middle of the call path, i.e. after the entry code has been generated and before it has been jumped to, the new frame has been pushed but the rejoin code assumes it still points to the old frame.  We then start patching random things into doubles.  This changes things so that ic::Call, stubs::UncachedCall etc. do not change regs->fp but store the new fp in regs->sp.  This is then reloaded after doing all necessary patching of the calling frame.

http://hg.mozilla.org/projects/jaegermonkey/rev/affaa35f4a14
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.