657120 - TI+JM: incorrect result with JSOP_AND, JSOP_LT

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

--
function f() {
    var x = Object(2);
    var y = 3.14;
    assertEq(true && x < y, true);
}
f();
--
$ ./js -n -m -a test.js
test.js:4: Error: Assertion failed: got false, expected true

Revision b92ac5a4ef47, 32-bit OS X. Old regression though, I can reproduce with a build from January.

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Patch

In jsop_relational_double, syncExit for the lhs has to be called before loading the rhs. I thought about adding a helper function but this pattern is not that common so I went with the straight-forward fix; suggestions welcome.

Comment 2

[Jan de Mooij [:jandem]]

http://hg.mozilla.org/projects/jaegermonkey/rev/807a6cc25c34