Bug 63880

Summary:

Evaluation order of conversions of operands to >, >= incorrect.

Product:

WebKit

Reporter:

Gavin Barraclough <barraclough>

Component:

JavaScriptCore

Assignee:

Gavin Barraclough <barraclough>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

eric

Priority:

Version:

528+ (Nightly build)

Hardware:

Unspecified

OS:

Unspecified

Bug Depends on:

63881

Bug Blocks:

Attachments:

Description	Flags
The code changes, will need updated layout test results.	none
The patch with updated Layout test results	sam: review+

Description Gavin Barraclough 2011-07-03 16:31:18 PDT

We handle all >, >= comparisons as a commuted < or <= respectively.  This is incorrect with respect to evaluation order of calls to ToPrimitive conversions.

Comment 1 Gavin Barraclough 2011-07-04 18:59:15 PDT

Created attachment 99664 [details]
The code changes, will need updated layout test results.

Comment 2 Gavin Barraclough 2011-07-04 20:16:19 PDT

Created attachment 99667 [details]
The patch with updated Layout test results

Comment 3 Gavin Barraclough 2011-07-04 20:18:11 PDT

The attached patch checks in a failing result for one sputnik test; the test is incorrect, more details in the ChangeLog.

(For other sputnik tests we have expected failures checked in; at some point we should remove the sputnik & ietestcenter suites & replace with a copy of test-262, license permitting).

Comment 4 Gavin Barraclough 2011-07-05 12:02:15 PDT

Fixed in r90401

Comment 5 Eric Seidel (no email) 2011-07-05 23:04:10 PDT

Either this, or https://bugs.webkit.org/show_bug.cgi?id=63947 appears to have broken all JSC builds other than Snow Leopard.  At least Leopard, Win and Qt are crashing all tests.