76976 - RegExp.prototype.lastIndex now stops at 2^30 -1 (was 2^32-1)

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Phil Schwartau]

The fix for bug 76233 "Deadlock between regular expressions and GC"
is causing js/tests/ecma_2/RegExp/properties-002.js to fail.

This test sets regexp.lastIndex to high values:

re = /abc/;
re.lastIndex = Math.pow(2,31);
re.lastIndex = Math.pow(2,32)-1;
re.lastIndex = Math.pow(2,31)-1;
re.lastIndex = Math.pow(2,30)-1;
re.lastIndex = Math.pow(2,30);


But it now fails to recover any value higher than 2^30 -1:  

FAILED! re.lastIndex = 0           expected: 2147483648
FAILED! re.lastIndex = -1          expected: 4294967295
FAILED! re.lastIndex = -1          expected: 2147483647
PASSED! re.lastIndex = 1073741823  PASSED!
FAILED! re.lastIndex = undefined   expected: 1073741824


If I back out the changes made for bug 76233, the test passes:

PASSED! re.lastIndex = 2147483648 PASSED!
PASSED! re.lastIndex = 4294967295 PASSED!
PASSED! re.lastIndex = 2147483647 PASSED!
PASSED! re.lastIndex = 1073741823 PASSED!
PASSED! re.lastIndex = 1073741824 PASSED!


I observed that re.lastIndex used to cycle at 2^32:

js> re.lastIndex=Math.pow(2,32)-1
4294967295
js> re.lastIndex
4294967295
js> re.lastIndex=Math.pow(2,32)
4294967296
js> re.lastIndex
0


Whereas now it is becoming undefined at 2^30:

js> var re = /abc/
js> re.lastIndex = Math.pow(2,30)-1
1073741823
js> re.lastIndex
1073741823
js> re.lastIndex = Math.pow(2,30)
1073741824
js> re.lastIndex
js> re.lastIndex == undefined
true


I haven't found any ECMA spec for this, so it may not be a valid bug. 
In any case, the behavior has changed...

Comment 1

[Brendan Eich [:brendan]]

Dammit, my deadlock avoidance change was not supposed to do that.  Stupid jsval
int domain limits!

/be

Comment 2

[Brendan Eich [:brendan]]

Patch coming right up.

/be

Comment 3

[Brendan Eich [:brendan]]

Attachment: proposed fix

Comment 4

[Brendan Eich [:brendan]]

Screw it, I should not have busted this in 0.9.  Going for 0.9.

/be

Comment 5

[Christopher Blizzard (:blizzard)]

Get it into 0.9.

Comment 6

[Mike Shaver (:shaver emeritus)]

r=shaver.  (Who reviewed that silliness? =) )

Comment 7

[Brendan Eich [:brendan]]

You and beard reviewed the correct fix, then I checked in the wrong patch!  I
suck!  Thanks.

/be

Comment 8

[Phil Schwartau]

Verified Fixed with debug, optimized JS shells on WinNT and Linux.