Bug 31901 – Incorrect behaviour of jneq_null in the interpreter

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Oliver Hunt]

The interpreters implementation of op_jneq_null is incorrect when the value being compared is set to masquerade as undefined.  The result is that
if (document.all == null) {
    alert("PASS")
} else {
    alert("FAIL")
}
Will fail.

[Oliver Hunt]

Created attachment 43894 [details]
Patch

[Eric Seidel (no email)]

I'm sure Oliver will chase down the right people, but just in case.

[Eric Seidel (no email)]

Comment on attachment 43894 [details]
Patch

I would be happy to r+ this, as it sounds simple. Except w/o test result updates, it's difficult for me to see how it's correct.

[Oliver Hunt]

(In reply to comment #3)
> (From update of attachment 43894 [details])
> I would be happy to r+ this, as it sounds simple. Except w/o test result
> updates, it's difficult for me to see how it's correct.

The interpreter currently fails tests due to this -- the issue is that the existing logic will always short circuit on the isUndefinedOrNull for any cell -- eg. the type where we actually have to do the masquerade check.

[Eric Seidel (no email)]

Yeah, I think my confusion is just that I was surprised there were no test expectation changes in your patch.  That's all.

[Oliver Hunt]

Committed r51424