js_FillPropertyCache uses the wrong scope's shape sometimes

RESOLVED FIXED in mozilla1.9.1b1

Status

()

Core
JavaScript Engine
P1
major
RESOLVED FIXED
10 years ago
10 years ago

People

(Reporter: brendan, Assigned: brendan)

Tracking

Trunk
mozilla1.9.1b1
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite -
in-litmus -

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

10 years ago
The patch for bug 445899 lost the obj == pobj condition guarding the update of kshape (the filled entry's "key shape") from scope->shape (where scope is always OBJ_SCOPE(pobj)). This is bad, it happens to help cases where the got property is direct, but it guarantees a miss for indirect properties.

/be
(Assignee)

Updated

10 years ago
Priority: -- → P1
Target Milestone: --- → mozilla1.9.1b1
(Assignee)

Comment 1

10 years ago
Created attachment 337538 [details] [diff] [review]
fix

shaver's out sick, need to get this in. It exposes the rest of my arguments work being undone when I test v8/raytrace.js with this plus three other patches, but that's a good sign.

Passes the js testsuit with same failures as without.

/be
Attachment #337538 - Flags: review?(mrbkap)

Updated

10 years ago
Attachment #337538 - Flags: review?(mrbkap) → review+
(Assignee)

Comment 2

10 years ago
Fixed:

http://hg.mozilla.org/tracemonkey/rev/728cf8bf1648
http://hg.mozilla.org/mozilla-central/rev/71c48ddc9e8c

/be
Status: ASSIGNED → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED

Updated

10 years ago
Flags: in-testsuite-
Flags: in-litmus-
You need to log in before you can comment on or make changes to this bug.