Bug 23469

Summary:

switch (-1 * 0) { default: print("FAIL!"); case 0: }

Product:

WebKit

Reporter:

Gavin Barraclough <barraclough>

Component:

JavaScriptCore

Assignee:

Gavin Barraclough <barraclough>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

zherczeg

Priority:

Version:

528+ (Nightly build)

Hardware:

Mac

OS:

OS X 10.5

Attachments:

Description	Flags
The patch	none
Typo fix	oliver: review+

Description Gavin Barraclough 2009-01-21 19:06:25 PST

FAIL!

Comment 1 Mark Rowe (bdash) 2009-01-21 19:14:38 PST

Do we really add an exclamation point out of nowhere?

Comment 2 Gavin Barraclough 2009-01-21 19:52:53 PST

Created attachment 26920 [details]
The patch

Comment 3 Gavin Barraclough 2009-01-21 20:01:44 PST

Created attachment 26921 [details]
Typo fix

Comment 4 Oliver Hunt 2009-01-21 20:09:03 PST

Comment on attachment 26921 [details]
Typo fix

r=me, as long as there is a testcase

Comment 5 Gavin Barraclough 2009-01-21 20:28:49 PST

Sending        JavaScriptCore/ChangeLog
Sending        JavaScriptCore/interpreter/Interpreter.cpp
Sending        LayoutTests/ChangeLog
Sending        LayoutTests/fast/js/resources/switch-behaviour.js
Sending        LayoutTests/fast/js/switch-behaviour-expected.txt
Transmitting file data .....
Committed revision 40111.

Comment 6 Zoltan Herczeg 2009-01-27 01:20:07 PST

Hi,

the fix of this bug introduces a new bug. Consider the following code:

var a = 5.4

    switch(val) {
    case 1:
        return 10
    case 2:
        return 11
    case 3:
        return 12
    case 5:
        return 14
    case 6:
        return 15
    default:
        return 100
    }

The switch selects "case 5", because numberToInt32() converts 5.4 to 5, which is wrong in this case!

The right test should be something like this in case of scrutinee is a double value:
if ((double)((int)scrutinee) == scrutinee)
   ... ctiForValue((int)scrutinee)

Comment 7 Alexey Proskuryakov 2009-01-28 14:52:02 PST

Could you please file a new bug for this?