Closed
Bug 827104
Opened 12 years ago
Closed 11 years ago
IonMonkey: Differential Testing: is undefined vs. undefined has no properties
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla23
People
(Reporter: decoder, Assigned: evilpie)
References
Details
(Keywords: testcase, Whiteboard: [fuzzblocker])
Attachments
(1 file, 1 obsolete file)
2.52 KB,
patch
|
jandem
:
review+
|
Details | Diff | Splinter Review |
The following testcase shows different behavior with no options vs. --no-ti on mozilla-central revision 20d1a5916ef6: var a = []; for (var i = 0; i < 1000; i++) { a.x = {} } a[i][0] = 0; $ opt64/js test.js test.js:5:0 TypeError: can't convert undefined to object $ opt64/js --no-ti test.js test.js:5:0 TypeError: a[i] is undefined This is a fuzzblocker because it keeps popping up very frequently.
Reporter | ||
Comment 1•12 years ago
|
||
Seeing the same also for null (foo is null vs. null has no properties).
Assignee | ||
Comment 2•12 years ago
|
||
I hate this code. We should just get rid of the special error message. This fixes it, but I am not sure if it has bad effects on other stuff.
Assignee | ||
Comment 4•11 years ago
|
||
I think we can take this patch, this should strictly just improve the error reporting.
Flags: needinfo?(evilpies)
Assignee | ||
Updated•11 years ago
|
Assignee: general → evilpies
Assignee | ||
Comment 5•11 years ago
|
||
Verified, still passes and fixes the issue.
Assignee | ||
Updated•11 years ago
|
Attachment #698420 -
Flags: review?(jdemooij)
Comment 6•11 years ago
|
||
Comment on attachment 698420 [details] [diff] [review] fix Review of attachment 698420 [details] [diff] [review]: ----------------------------------------------------------------- Looks good, but please add a testcase that fails without the patch (and works with the patch + --baseline-eager)
Attachment #698420 -
Flags: review?(jdemooij) → review+
Assignee | ||
Comment 7•11 years ago
|
||
This fails with baseline at the moment.
Comment 9•11 years ago
|
||
(In reply to Tom Schuster [:evilpie] from comment #8) > Jan, any ideas on how to fix this? Changing ToObject to ToObjectFromStack in DoSetElemFallback seems to work for me..
Flags: needinfo?(jdemooij)
Assignee | ||
Comment 10•11 years ago
|
||
You are right. Failure on my part.
Attachment #698420 -
Attachment is obsolete: true
Attachment #744776 -
Flags: review?(jdemooij)
Updated•11 years ago
|
Attachment #744776 -
Flags: review?(jdemooij) → review+
Comment 11•11 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/a7e44219367a
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla23
You need to log in
before you can comment on or make changes to this bug.
Description
•