Closed Bug 625377 Opened 13 years ago Closed 13 years ago

JM: incorrect output for testcase involving for..in, delete

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
normal

Tracking

()

RESOLVED FIXED
Tracking Status
blocking2.0 --- final+

People

(Reporter: jandem, Assigned: dvander)

References

Details

(Keywords: regression, testcase, Whiteboard: [hardblocker][fixed-in-tracemonkey])

Attachments

(2 files)

Attached file Testcase
The attached testcase should print:
onetwo
onetwo
onetwo

./js -m (32-bit OS X):
onetwo
onetwoundefined
onetwoundefined

Uncommenting the gc() call fixes it. Seems related to bug 618614.
blocking2.0: --- → ?
Keywords: regression, testcase
Here's a simpler testcase:
---
for(var i=0; i<3; i++) {
    var obj = { first: "first", second: "second" };
    var count = 0;
    for (var elem in obj) {
        delete obj.second;
        count++;
    }
    print(count);
}
---
This should print: 
1
1
1

Output with -m (32-bit OS X):
1
2
2
Assignee: general → dvander
Status: NEW → ASSIGNED
Easy bug. The method JIT is not updating ni->obj so property deletion suppression doesn't fix up the iterator. We had a similar bug for the interpreter.
blocking2.0: ? → final+
Attached patch fixSplinter Review
This patch also cleans up some really old code and assumptions (like, assuming that iterators won't work on X64 - 3% SunSpider win).
Attachment #503553 - Flags: review?(lw)
Whiteboard: hardblocker
Comment on attachment 503553 [details] [diff] [review]
fix

Nice
Attachment #503553 - Flags: review?(lw) → review+
Whew! Nice ifdef reduction.

/be
http://hg.mozilla.org/tracemonkey/rev/7b3e7428113c
Whiteboard: hardblocker → [hardblocker][fixed-in-tracemonkey]
http://hg.mozilla.org/mozilla-central/rev/7b3e7428113c
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: