Fix assert when comparing identical values, bug 599488. r=dvander

This commit is contained in:
Brian Hackett 2010-09-25 10:47:19 -07:00
parent bd21beac91
commit 944cb69b95
2 changed files with 11 additions and 0 deletions

View File

@ -722,6 +722,8 @@ mjit::Compiler::jsop_relational(JSOp op, BoolStub stub, jsbytecode *target, JSOp
emitStubCmpOp(stub, target, fused);
} else if (!target && (lhs->isType(JSVAL_TYPE_STRING) || rhs->isType(JSVAL_TYPE_STRING))) {
emitStubCmpOp(stub, target, fused);
} else if (frame.haveSameBacking(lhs, rhs)) {
emitStubCmpOp(stub, target, fused);
} else {
jsop_equality_int_string(op, stub, target, fused);
}

View File

@ -0,0 +1,9 @@
/* Don't crash. */
function foo(y) {
var x = y;
if (x != x)
return true;
return false;
}
assertEq(foo("three"), false);
assertEq(foo(NaN), true);