507231 - ABORT_IF_XML does not guarantee no XML at runtime

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[Jason Orendorff [:jorendorff]]

As a result, XML objects can end up being treated like regular old objects in several places. This test passes without -j, fails with -j.

var arr = [{}, {},
           {}, {},
           {}, {},
           {}, {},
           <x/>, <x/>];  // these last two are equal
var s = '';
for (var i = 0; i < arr.length; i += 2) {
    if (arr[i] == arr[i + 1])
        s += i;
}
assertEq(s, "8");  // got "", expected "8" with -j

Comment 1

[Jason Orendorff [:jorendorff]]

We could have ABORT_IF_XML emit a guard. That seems heinous. We could split XML objects out into their own trace type, TT_XML. But that might be even worse; we would pay for that every time we unbox an object on trace.

Comment 2

[Tom S [:evilpie]]

E4X is gone.