Closed Bug 657120 Opened 9 years ago Closed 9 years ago

TI+JM: incorrect result with JSOP_AND, JSOP_LT

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Assigned: jandem)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

--
function f() {
    var x = Object(2);
    var y = 3.14;
    assertEq(true && x < y, true);
}
f();
--
$ ./js -n -m -a test.js
test.js:4: Error: Assertion failed: got false, expected true

Revision b92ac5a4ef47, 32-bit OS X. Old regression though, I can reproduce with a build from January.
Assignee: general → jandemooij
Status: NEW → ASSIGNED
Attached patch PatchSplinter Review
In jsop_relational_double, syncExit for the lhs has to be called before loading the rhs. I thought about adding a helper function but this pattern is not that common so I went with the straight-forward fix; suggestions welcome.
Attachment #532611 - Flags: review?(bhackett1024)
Attachment #532611 - Flags: review?(bhackett1024) → review+
http://hg.mozilla.org/projects/jaegermonkey/rev/807a6cc25c34
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.