792234 - IonMonkey: Differential Testing (--ion-eager): value of ('' / undefined) differs

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

+++ This bug was initially created as a clone of Bug #789300 +++

try {
    (function() {
        Object.defineProperty(this, "s0", {
            get: function() {
                Object.defineProperty(this.t1, 7, {
                    value: '' / window
                })
            }
        })
    })()
    {
        a2 = []
    }
    s0 + ''
} catch (e) {}
try {
    t1 = (a2)
    gc()
    s0 + 2
    function window() {}
    b = this.s0;
    print(function(){});
    var window = (""),
        al
} catch (e) {}

shows the following on 64-bit js opt shell on IonMonkey changeset 93ebcdb7b37b without --ion-eager:

function () {}

but shows nothing (except newlines?) with --ion-eager, when the testcase is passed in as a CLI argument.

Spun off from bug 789300 comment 2, since the patch in bug 789300 comment 3 fixes bug 789300 comment 0 but not this testcase.

Comment 1

[Sean Stangl [:sstangl]]

Reduced testcase:

function foo() {
  return '' / undefined;
}

foo();
assertEq(foo(), NaN);

Comment 2

[Sean Stangl [:sstangl]]

Attachment: Remove erroneous folding for MDiv.

Fixes reduced and full testcases.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 662329 [details] [diff] [review]
Remove erroneous folding for MDiv.

Review of attachment 662329 [details] [diff] [review]:
-----------------------------------------------------------------

Can you see if this closes bug 758376  as well?

Comment 4

[Sean Stangl [:sstangl]]

(In reply to David Anderson [:dvander] from comment #3)
> Can you see if this closes bug 758376  as well?

It does.

Comment 6

[Sean Stangl [:sstangl]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/6841c56d5d78

Comment 7

[Graeme McCutcheon [:graememcc]]

https://hg.mozilla.org/mozilla-central/rev/6841c56d5d78