jalangi2
jalangi2 copied to clipboard
Wrong floating point semantics for postfix operations.
The numeric postfix operation instrumentations does not preserve floating point semantics.
Example
Source:
var a = 0.15;
console.log(a);
console.log(a++);
console.log(a);
Uninstrumented & Instrumented runs:
$ node test.js
0.15
0.15
1.15
$ node src/js/commands/jalangi.js test.js
0.15
0.1499999999999999
1.15
Explanation
Ideally, the value of a postfix expression is the initial value, but the adjustIncDec
function in esnstrument.js subtracts/adds 1
to the modified value instead. But this has an unfortunate effect on floating point numbers, as seen above.
Instrumented:
...
J$.X1(65, J$.B(26, '-', a = J$.W(49, 'a', J$.B(18, '+', J$.U(10, '+', J$.R(41, 'a', a, 0)), J$.T(33, 1, 22, false), 0), a, 0), J$.T(57, 1, 22, false), 0));
...