Closed Bug 698367 Opened 13 years ago Closed 13 years ago

Unary operators do not handle valueOf conversion returning non-Number on objects of known type

Categories

(Tamarin Graveyard :: Virtual Machine, defect)

Product:
Tamarin Graveyard
Component:
Virtual Machine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

(Not tracked)

Status:
VERIFIED FIXED

People

(Reporter: lhansen, Unassigned)

References

Details

Mac32 Debug off 28 October queue, -abcfuture, -Ojit.

See https://bugzilla.mozilla.org/show_bug.cgi?id=615489#c25 for background.  Unary operators assume Number in the fallthrough case for objects of known type but can assume only "Numeric".

Test case (won't compile with -strict of course):

  class C {}
  C.prototype.valueOf = function () { return float4(1,1,1,1); };
  var c:C = new C;  // It's important that the :C is here
  print(-c);

This prints "NaN" but should have printed "-1,-1,-1,-1".
Summary: Unary operators do not handle valueOf property on objects of known type → Unary operators do not handle valueOf conversion on objects of known type with -Ojit
I don't think this is tied to the JIT since I get the same result if I use -Dinterp (mac64 debug-debugger 321:2056bcae3a1b)
Flags: in-testsuite?
Flags: flashplayer-triage+
Flags: flashplayer-qrb+
Flags: flashplayer-bug-
QA Contact: vm → brbaker
Summary: Unary operators do not handle valueOf conversion on objects of known type with -Ojit → Unary operators do not handle valueOf conversion returning non-Number on objects of known type
Fixed with changeset 6803:29f8fc78e84f (before that, actually, but this changeset adds uniform handling of all unary ops)
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Testmedia added in changeset 7072:536478c964aa

Reopening bug as the JIT currently is not handling this properly.

The float4() testcase is returning NaN
The float() testcase is returning a Number value instead of a float value.
Status: RESOLVED → REOPENED
Flags: in-testsuite? → in-testsuite+
Resolution: FIXED → ---
true; fixed in changeset 7073:ef1963febdfb.
Root cause: I expected in this case the builtin type of the var would be "BUILTIN_object", instead it was "BUilTIN_none".
Now all thee are tested (BUILTIN_object, BUILTIN_none, BUILTIN_any) - this should cover all non-numeric cases that can implicitly convert to float/float4.
Status: REOPENED → RESOLVED
Closed: 13 years ago → 13 years ago
Resolution: --- → FIXED
changeset:   7075:001ff511dabc
tag:         tip
user:        Brent Baker <brbaker@adobe.com>
date:        Tue Dec 13 10:28:06 2011 -0500
summary:     Bug 698367: remove expected failures now that bug is fixed.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.