Bug 63880

Summary: Evaluation order of conversions of operands to >, >= incorrect.
Product: WebKit Reporter: Gavin Barraclough <barraclough>
Component: JavaScriptCoreAssignee: Gavin Barraclough <barraclough>
Severity: Normal CC: eric
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on: 63881    
Bug Blocks:    
Description Flags
The code changes, will need updated layout test results.
The patch with updated Layout test results sam: review+

Description Gavin Barraclough 2011-07-03 16:31:18 PDT
We handle all >, >= comparisons as a commuted < or <= respectively.  This is incorrect with respect to evaluation order of calls to ToPrimitive conversions.
Comment 1 Gavin Barraclough 2011-07-04 18:59:15 PDT
Created attachment 99664 [details]
The code changes, will need updated layout test results.
Comment 2 Gavin Barraclough 2011-07-04 20:16:19 PDT
Created attachment 99667 [details]
The patch with updated Layout test results
Comment 3 Gavin Barraclough 2011-07-04 20:18:11 PDT
The attached patch checks in a failing result for one sputnik test; the test is incorrect, more details in the ChangeLog.

(For other sputnik tests we have expected failures checked in; at some point we should remove the sputnik & ietestcenter suites & replace with a copy of test-262, license permitting).
Comment 4 Gavin Barraclough 2011-07-05 12:02:15 PDT
Fixed in r90401
Comment 5 Eric Seidel (no email) 2011-07-05 23:04:10 PDT
Either this, or https://bugs.webkit.org/show_bug.cgi?id=63947 appears to have broken all JSC builds other than Snow Leopard.  At least Leopard, Win and Qt are crashing all tests.