192105 - instanceof to check if function is a constructor is broken when optimization >= 1

Status: VERIFIED FIXED

(Rhino Graveyard :: Compiler, defect)

Description

[Igor Bukanov]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.0.1) Gecko/20021003
Build Identifier: Rhino CVS 2003-01-04

With optimization set to 1 or higher instanceof inside a function to test if the
function is called as a constructor or not returns false if the function is
called as constructor from some other function.

Reproducible: Always

Steps to Reproduce:
Run the following attached test case with rhino shell with optimization set to 1.
Actual Results:  
The test case prints FAILED

Expected Results:  
It should print OK

The test case ecma_3/Exceptions/regress-181914.js from the js test suite fails
with an infinite recursion for exactly this reason, just run it via jsDriver.pl
with the engine set to rhino9.

Comment 1

[Igor Bukanov]

Attachment: The test case

Comment 2

[Igor Bukanov]

Since the bug is present in Rhino 1.5R3, the fix should wait until 1.5R4 is
released.

Comment 3

[Phil Schwartau]

Testcase added to JS testsuite:

      mozilla/js/tests/js1_5/Object/regress-192105.js

This passes in SpiderMonkey and in Rhino when optimization < 1.
But, as Igor reported, it fails if Rhino optimization is set >=1:

java org.mozilla.javascript.tools.shell.Main -opt 1
                             -f mozilla/js/tests/js1_5/shell.js
                             -f mozilla/js/tests/js1_5/Object/regress-192105.js


FAILED!: [reported from test()] Section 3 of test -
FAILED!: [reported from test()] Expected value 'true', Actual value 'false'
FAILED!: [reported from test()]
FAILED!: [reported from test()] Section 5 of test -
FAILED!: [reported from test()] Expected value 'true', Actual value 'false'
FAILED!: [reported from test()]
FAILED!: [reported from test()] Section 7 of test -
FAILED!: [reported from test()] Expected value 'true', Actual value 'false'


Sections 3, 5, and 7 are precisely those which test if the
function is called as constructor from some other function -

Comment 4

[Igor Bukanov]

Attachment: Fixing incorrect double call to setPrototype when generating constructDirect

The reason for the bug is that emitDirectConstructor generates code to call
setPrototype twice instead of setPrototype/setParentScope pair during new JS
object construction. The fix replaces that setup by a single call to
BaseFunction.createObject which is used by Interpreter as well.

Comment 5

[Igor Bukanov]

I commited the fix

Comment 6

[Phil Schwartau]

Verified FIXED.

The above testcase now passes in the Rhino shell.
I tested optimization levels -1, 0, 1, and 9.

Comment 7

[Igor Bukanov]

Targeting as resolved against 1.5R5