regression (from firefox 2): prototype setters not called by inline cache for [[put]]

RESOLVED FIXED in mozilla1.9.1

Status

()

Core
JavaScript Engine
P2
normal
RESOLVED FIXED
10 years ago
9 years ago

People

(Reporter: Geoffrey Garen, Assigned: brendan)

Tracking

({regression, testcase})

Trunk
mozilla1.9.1
regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
wanted1.9.1 +
wanted1.9.0.x +
in-testsuite ?

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(3 attachments, 1 obsolete attachment)

(Reporter)

Description

10 years ago
User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_4; en-us) AppleWebKit/525.18 (KHTML, like Gecko) Version/3.1.1 Safari/525.20
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.1) Gecko/2008070206 Firefox/3.0.1

If a setter is added to the prototype chain after a body of code has specialized for [[put]], the specialized body of code will fail to call the setter. 

This is a regression from Firefox 2.

See attached test case (coming soon!).

Reproducible: Always

Steps to Reproduce:
Load attached test case.
Actual Results:  
"FAIL"

Expected Results:  
"PASS"
(Reporter)

Comment 1

10 years ago
Created attachment 335491 [details]
test case
This testcase regressed between 2008020700 (works) and 2008020800 (fails).
Smaller range: 
http://bonsai.mozilla.org/cvsquery.cgi?module=PhoenixTinderbox&date=explicit&mindate=2008-02-07+14%3A00&maxdate=2008-02-07+16%3A00
Assignee: nobody → general
Blocks: 365851
Status: UNCONFIRMED → NEW
Component: General → JavaScript Engine
Ever confirmed: true
Keywords: regression, testcase
OS: Mac OS X → All
Product: Firefox → Core
QA Contact: general → general
Hardware: PC → All
Version: unspecified → Trunk
Flags: blocking1.9.1?
Created attachment 335591 [details] [diff] [review]
Proposed fix
Assignee: general → mrbkap
Status: NEW → ASSIGNED
Attachment #335591 - Flags: review?(brendan)
Created attachment 335593 [details]
testcase for the shell

This is a simplified testcase for the shell.
(Assignee)

Comment 6

10 years ago
Fixed on tm:

http://hg.mozilla.org/tracemonkey/index.cgi/rev/4714cee8d904

and on m-c:

http://hg.mozilla.org/mozilla-central/index.cgi/rev/a2ae40e570a7

/be
Status: ASSIGNED → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED
Let's get this into the branch as a regression fix, if it bakes well on trunk for a bit.
Flags: blocking1.9.0.3?
(Assignee)

Comment 8

10 years ago
Sorry! Comment 6 is in the wrong bug.

/be
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
(Assignee)

Updated

10 years ago
Assignee: mrbkap → brendan
Status: REOPENED → NEW
(Assignee)

Updated

10 years ago
Status: NEW → ASSIGNED
Priority: -- → P1
Target Milestone: --- → mozilla1.9.1
(Assignee)

Updated

10 years ago
Attachment #335591 - Flags: review?(brendan)

Updated

10 years ago
Priority: P1 → P2

Updated

10 years ago
Flags: blocking1.9.1? → blocking1.9.1+
This bug is not fixed on trunk despite an old patch, and apparently missed "baking" in the beta. Is it realistic to block a branch release for it?
Flags: wanted1.9.0.x+
Flags: in-testsuite?
Flags: blocking1.9.0.4?
(Assignee)

Comment 10

10 years ago
(In reply to comment #9)
> This bug is not fixed on trunk despite an old patch, and apparently missed
> "baking" in the beta. Is it realistic to block a branch release for it?

Certainly not. Should have a patch for the next next release.

/be

Updated

10 years ago
Attachment #335591 - Flags: review?(brendan)
(Assignee)

Comment 11

10 years ago
Comment on attachment 335591 [details] [diff] [review]
Proposed fix

I hope to fix this differently.

/be
Attachment #335591 - Flags: review?(brendan) → review-

Updated

10 years ago
Flags: blocking1.9.1+ → wanted1.9.1+
(Assignee)

Comment 12

9 years ago
Created attachment 376377 [details] [diff] [review]
fix
Attachment #335591 - Attachment is obsolete: true
Attachment #376377 - Flags: review?(mrbkap)

Updated

9 years ago
Attachment #376377 - Flags: review?(mrbkap) → review+
(Assignee)

Comment 13

9 years ago
Fixed in tm:

http://hg.mozilla.org/tracemonkey/rev/cffb2a5d4489

/be
Whiteboard: fixed-in-tracemonkey
(Assignee)

Comment 14

9 years ago
Fixed in m-c:

http://hg.mozilla.org/mozilla-central/rev/8c9a6d851018

/be
Status: ASSIGNED → RESOLVED
Last Resolved: 10 years ago9 years ago
Resolution: --- → FIXED
This checkin is in a range suspected to have caused a TXul regression on OSX:

Regression: Txul increase from 312.789 to 326.947 (4.53%) on Sun May 10 16:20:00 2009. Mac105 1.9.2 build 20090510132032
   http://graphs.mozilla.org/#show=794371,794398,794384&sel=1241813896,1242159496
   http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=6ea54bfd7c28&tochange=a6068cf686fe
Filed bug 492355 to track that regression.

Comment 17

9 years ago
(In reply to comment #12)
> Created an attachment (id=376377) [details]
> fix

Hm, this purges just the property cache for the current thread. It does not take care about the cache embedded into the jited code or on other threads.
(Assignee)

Comment 18

9 years ago
(In reply to comment #17)
> (In reply to comment #12)
> > Created an attachment (id=376377) [details] [details]
> > fix
> 
> Hm, this purges just the property cache for the current thread. It does not
> take care about the cache embedded into the jited code or on other threads.

See bug 492355.

/be
You need to log in before you can comment on or make changes to this bug.