Closed
Bug 792234
Opened 12 years ago
Closed 12 years ago
IonMonkey: Differential Testing (--ion-eager): value of ('' / undefined) differs
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla18
People
(Reporter: gkw, Assigned: sstangl)
References
Details
(Keywords: regression, testcase, Whiteboard: [ion:p1:fx18])
Attachments
(1 file)
|
(deleted),
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
+++ This bug was initially created as a clone of Bug #789300 +++
try {
(function() {
Object.defineProperty(this, "s0", {
get: function() {
Object.defineProperty(this.t1, 7, {
value: '' / window
})
}
})
})()
{
a2 = []
}
s0 + ''
} catch (e) {}
try {
t1 = (a2)
gc()
s0 + 2
function window() {}
b = this.s0;
print(function(){});
var window = (""),
al
} catch (e) {}
shows the following on 64-bit js opt shell on IonMonkey changeset 93ebcdb7b37b without --ion-eager:
function () {}
but shows nothing (except newlines?) with --ion-eager, when the testcase is passed in as a CLI argument.
Spun off from bug 789300 comment 2, since the patch in bug 789300 comment 3 fixes bug 789300 comment 0 but not this testcase.
|
Reporter | |
Updated•12 years ago
|
Summary: IonMonkey: Differential Testing: Getting different output w/without --ion-eager → IonMonkey: Differential Testing: Getting different output w/without --ion-eager with gc
|
Assignee | |
Comment 1•12 years ago
|
||
Reduced testcase:
function foo() {
return '' / undefined;
}
foo();
assertEq(foo(), NaN);
|
|
Assignee | |
Comment 2•12 years ago
|
||
Fixes reduced and full testcases.
Attachment #662329 -
Flags: review?(dvander)
Comment on attachment 662329 [details] [diff] [review]
Remove erroneous folding for MDiv.
Review of attachment 662329 [details] [diff] [review]:
-----------------------------------------------------------------
Can you see if this closes bug 758376 as well?
Attachment #662329 -
Flags: review?(dvander) → review+
|
|
Assignee | |
Comment 4•12 years ago
|
||
(In reply to David Anderson [:dvander] from comment #3)
> Can you see if this closes bug 758376 as well?
It does.
|
|
Assignee | |
Comment 6•12 years ago
|
||
Group: core-security
|
||
Updated•12 years ago
|
Summary: IonMonkey: Differential Testing: Getting different output w/without --ion-eager with gc → IonMonkey: Differential Testing (--ion-eager): value of ('' / undefined) differs
|
||
Comment 7•12 years ago
|
||
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla18
You need to log in
before you can comment on or make changes to this bug.
Description
•