overzealous eval-inside-function optimization in BindNameToSlot

RESOLVED FIXED

Status

()

RESOLVED FIXED
10 years ago
10 years ago

People

(Reporter: igor, Assigned: igor)

Tracking

({testcase})

Trunk
testcase
Points:
---
Bug Flags:
in-testsuite +
in-litmus -

Firefox Tracking Flags

(Not tracked)

Details

(Assignee)

Description

10 years ago
The display optimization for the eval in BindNameToSlot from jsemit.cpp ignores possible with blocks in outer function. The following session demonstrates the problem with the current mozilla-central tip:

~/m/31-ff/js/tests $ cat ~/s/x.js
var obj = { x: -100 };

function a(x)
{
    var orig_x = x;
    var orig_obj_x = obj.x;

    with (obj) { eval("x = x + 10"); }

    if (x !== orig_x)
        throw "Unexpected mutation of x: " + x;
    if (obj.x !== orig_obj_x + 10)
        throw "Unexpected mutation of obj.x: " + obj.x;
}

a(0);
~/m/31-ff/js/tests $ ~/m/31-ff/js/src/Linux_All_DBG.OBJ/js ~/s/x.js
uncaught exception: Unexpected mutation of obj.x: 10
(Assignee)

Comment 1

10 years ago
Here is another problem: the current code incorrectly optimizes the access to the arguments object as the following session demonstrates:

~/m/31-ff/js/tests $ cat ~/s/x.js
var obj = { arguments: [-100] };

function a()
{
    with (obj) { return eval("arguments[0]"); }
}

function b()
{
    eval('with (obj) { return eval("arguments[0]"); };');
}

var result = a();
if (result !== -100)
    throw "Bad result"+uneval(result);

var result = b();
if (result !== -100)
    throw "Bad result"+uneval(result);

print("Ok");
~/m/31-ff/js/tests $ ~/m/31-ff/js/src/Linux_All_DBG.OBJ/js ~/s/x.js
uncaught exception: Bad result(void 0)
(Assignee)

Updated

10 years ago
Depends on: 446386
(Assignee)

Comment 2

10 years ago
This was fixed within the fix for the bug 446386,
Status: NEW → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED

Updated

10 years ago
Keywords: testcase

Comment 3

10 years ago
Igor: is SyntaxError: return not in function expected in comment 1? I see it in 1.8.0 and 1.9.1. 1.9.0 has the same error as originally reported on 1.9.1.
(Assignee)

Comment 4

10 years ago
(In reply to comment #3)
> Igor: is SyntaxError: return not in function expected in comment 1? I see it in
> 1.8.0 and 1.9.1. 1.9.0 has the same error as originally reported on 1.9.1.

That test case is bad. The proper one would have for the function b:

function b()
{
    var result;
    eval('with (obj) { result = eval("arguments[0]"); };');
    return result;
}

Comment 5

10 years ago
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-452742-01.js,v  <--  regress-452742-01.js
initial revision: 1.1

/cvsroot/mozilla/js/tests/js1_5/Regress/regress-452742-02.js,v  <--  regress-452742-02.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/f0e9fd501e63
Flags: in-testsuite+
Flags: in-litmus-
You need to log in before you can comment on or make changes to this bug.