Last Comment Bug 652590 - TI+JM: incorrect result with JSOP_OR, double
: TI+JM: incorrect result with JSOP_OR, double
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: general
:
Mentors:
Depends on:
Blocks: infer-regress
  Show dependency treegraph
 
Reported: 2011-04-25 11:34 PDT by Jan de Mooij [:jandem] (PTO until July 31)
Modified: 2011-04-26 23:34 PDT (History)
4 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Jan de Mooij [:jandem] (PTO until July 31) 2011-04-25 11:34:16 PDT
--
function f() {
    var x = undefined ? 1 : 4294967295;
    print(false || x);
}
f();
--
$ ./js test.js
4294967295

$ ./js -n -m -a test.js
-2147483648

Revision 8f0c5e12eba9, 32-bit OS X. This seems to be a recent regression.
Comment 1 Brian Hackett (:bhackett) 2011-04-26 23:34:15 PDT
When fixing double types before branching, we did not necessarily know the variable was previously an integer and could convert existing doubles, then get 0x80000000 when trying to convert them back to integers after the branch.  We should only be converting entries that are definitely integers before branching, so this fix ensures that variables inferred as doubles are always maintained as doubles by the FrameState, including within basic blocks (we were already normally doing this, but areas where we lose precision like the stack values transmitted by the '?' operator needed to be accounted for).

http://hg.mozilla.org/projects/jaegermonkey/rev/89d2095c7a87

Note You need to log in before you can comment on or make changes to this bug.