Closed Bug 456479 Opened 16 years ago Closed 16 years ago

TM: correctness bug with undefined turning into NaN

Categories

(Core :: JavaScript Engine, defect, P1)

Product:
Core
Component:
JavaScript Engine
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
mozilla1.9.1b2

People

(Reporter: dvander, Assigned: dvander)

References

Details

(Keywords: verified1.9.1)

Attachments

(1 file)

breaking case
(deleted), application/x-javascript
Details
Attached file breaking case (deleted) —
In the fourth run of this loop we have a tree compiled for doubles. undefined gets changed to a NaN and the val is undefined and gets changed to a NaN as well. NaNs do not compare so a[i] is false with the JIT on, but true with the interpreter (since it is not using doubles).
Depends on: 456588
Oops, does not depend on bug 456588, since this bug is about missing arguments. This is the t/3d-raytrace.js problem too, though -- bug 454315. /be
Blocks: 454315
No longer depends on: 456588
Assignee: general → danderson
Flags: blocking1.9.1?
OS: Mac OS X → All
Hardware: PC → All
Target Milestone: --- → mozilla1.9.1
Flags: blocking1.9.1? → blocking1.9.1+
Priority: -- → P1
Target Milestone: mozilla1.9.1 → mozilla1.9.1b2
Fixed now that multitrees has landed. Pushed test case as changeset: http://hg.mozilla.org/tracemonkey/rev/e33ca6afff2a
Status: NEW → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
please set back to RESOLVED FIXED after landing in mozilla-central. Thanks.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Already landed in mozilla-central.
Status: REOPENED → RESOLVED
Closed: 16 years ago → 16 years ago
Resolution: --- → FIXED
thanks david. what's the easiest way i can tell that is has in the bug? from what i read here, it isnt obvious to me unless i actually had a chance to open up the fix on the trunk.
Hrm, I don't think there's no easy way other than looking at when tm was last pushed to m-c. From the m-c changelog: e36b9418613b 2008-11-16 02:44 -0500 Robert Sayre - Merge m-c to tracemonkey. So anything before that date has landed.
test already in js1_8_1/trace/trace-test.js
Flags: in-testsuite+
Flags: in-litmus-
v 1.9.1, 1.9.2
Status: RESOLVED → VERIFIED
Keywords: fixed1.9.1 → verified1.9.1
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: