Bug 504520 - TM: a >= b misbehaves if a and b are both Infinity at record time. r=Waldo.

--HG--
extra : rebase_source : 3debe2d9be81aa923e8d94081b189fd577a21287

js/src/jstracer.cpp

@@ -7106,24 +7106,24 @@ TraceRecorder::incElem(jsint incr, bool pre)
 }
 
 static bool
-evalCmp(LOpcode op, double result)
+evalCmp(LOpcode op, double l, double r)
 {
     bool cond;
     switch (op) {
       case LIR_feq:
-        cond = (result == 0);
+        cond = (l == r);
         break;
       case LIR_flt:
-        cond = result < 0;
+        cond = l < r;
         break;
       case LIR_fgt:
-        cond = result > 0;
+        cond = l > r;
         break;
       case LIR_fle:
-        cond = result <= 0;
+        cond = l <= r;
         break;
       case LIR_fge:
-        cond = result >= 0;
+        cond = l >= r;
         break;
       default:
         JS_NOT_REACHED("unexpected comparison op");
@@ -7132,18 +7132,12 @@ evalCmp(LOpcode op, double result)
     return cond;
 }
 
-static bool
-evalCmp(LOpcode op, double l, double r)
-{
-    return evalCmp(op, l - r);
-}
-
 static bool
 evalCmp(LOpcode op, JSString* l, JSString* r)
 {
     if (op == LIR_feq)
         return js_EqualStrings(l, r);
-    return evalCmp(op, js_CompareStrings(l, r));
+    return evalCmp(op, js_CompareStrings(l, r), 0);
 }
 
 JS_REQUIRES_STACK void

js/src/trace-test.js

@@ -3660,6 +3660,51 @@ function testComparisons()
 testComparisons.expected = "no failures reported!";
 test(testComparisons);
 
+function testBug504520() {
+    // A bug involving comparisons.
+    var arr = [1/0, 1/0, 1/0, 1/0, 1/0, 0];
+    assertEq(arr.length > RUNLOOP, true);
+
+    var s = '';
+    for (var i = 0; i < arr.length; i++)
+        arr[i] >= 1/0 ? null : (s += i);
+    assertEq(s, '5');
+}
+test(testBug504520);
+
+function testBug504520Harder() {
+    // test 1024 similar cases
+    var vals = [1/0, -1/0, 0, 0/0];
+    var ops = ["===", "!==", "==", "!=", "<", ">", "<=", ">="];
+    for each (var x in vals) {
+        for each (var y in vals) {
+            for each (var op in ops) {
+                for each (var z in vals) {
+                    // Assume eval is correct. This depends on the global
+                    // Infinity property not having been reassigned.
+                    var xz = eval(x + op + z);
+                    var yz = eval(y + op + z);
+
+                    var arr = [x, x, x, x, x, y];
+                    assertEq(arr.length > RUNLOOP, true);
+                    var expected = [xz, xz, xz, xz, xz, yz];
+
+                    // ?: looks superfluous but that's what we're testing here
+                    var fun = eval(
+                        '(function (arr, results) {\n' +
+                        '    for (let i = 0; i < arr.length; i++)\n' +
+                        '        results.push(arr[i]' + op + z + ' ? "true" : "false");\n' +
+                        '});\n');
+                    var actual = [];
+                    fun(arr, actual);
+                    assertEq("" + actual, "" + expected);
+                }
+            }
+        }
+    }
+}
+test(testBug504520Harder);
+
 function testCaseAbort()
 {
   var four = "4";