TI+JM: incorrect result with x++, -0

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: jandem, Unassigned)

Tracking

(Blocks: 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

6 years ago
--
function f() {
    var x = -0;
    x++;
    if (3 > 2) {};
    var y = x + 2.14;
    assertEq(y, 3.14);
}
f();
--
$ ./js -n -a -m test.js
test.js:6: Error: Assertion failed: got 1, expected 3.14

Revision 09461ee64436, 32-bit OS X.
(Reporter)

Updated

6 years ago
Summary: TI+JM: incorrect result with ++x → TI+JM: incorrect result with x++, -0
There is an invariant in place that for locals and args which have been inferred as doubles, the representation used by the FrameState is also a double.  We were checking this after SETLOCAL and SETARG, but not other ops which write to locals and args (thought that an INCLOCAL etc. applied to a double would end up with a double entry, which this example disproves).  The fix centralizes this logic into updateVarType (existing function used to track the current inferred types for each variable).

http://hg.mozilla.org/projects/jaegermonkey/rev/2ef9b9d500d4
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.