706710 - JS Correctness: Strict warning with -n vs no error without options

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

void options('strict')
try {
    ''.a++
} catch (e) {}

on m-c changeset 95bca70369ef, without -n:

js> void options('strict')
js> try {
    ''.a++
} catch (e) {}
NaN
js> 

with -n:

js> void options('strict')
js> try {
    ''.a++
} catch (e) {}
typein:3: strict warning: reference to undefined property "a"
NaN
js> 


autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   76046:3273738a165e
user:        Brian Hackett
date:        Sat Jul 16 08:25:22 2011 -0700
summary:     [INFER] Decompose property inc/dec ops for JM and TI, bug 647624.

Comment 1

[David Mandelin [:dmandelin]]

Brian, can you take a look at this? Error vs. no error has potential for web compat problems.

Comment 2

[Brian Hackett [Laid off!]]

The -n behavior is correct here.  This is not an issue with "use strict" code but rather the special strict option used in some (all?) chrome code.  The read of the undefined property is suppressed when executing as a fused PROPINC, but shows up as a normal property read in the decomposed version of the code.  On trunk the latter is only used with -n, but after objshrink merges the decomposed version will always be executed and the warning should always appear (PROPINC will be a no-op).

Comment 3

[David Mandelin [:dmandelin]]

Nice. Is there an ObjShrink bug this one can depend on?

Comment 4

[Brian Hackett [Laid off!]]

WFM on trunk with the objshrink merge, same warning regardless of options.