462504 - Looping over array values skips values if loop variable is changed

Status: RESOLVED DUPLICATE of bug 458851

(Core :: JavaScript Engine, defect)

Description

[Wladimir Palant]

Got an error from one of my automated tests, managed to refine the problem to this code:

  let data = "1 2 3 4 5 6 7 8 9 10".split(" ");

  let result = [];
  for each (let entry in data)
  {
    entry = 2;
    result.push(entry);
  }
  alert(result.length + " " + data.length);

Both data and result should have the same length after this code runs - but instead I get "6 10", so four array entries have been skipped. Switching off JIT or not modifying loop variable gives the expected result - "10 10". Given that 20081027 build worked fine whereas 20081030 build shows this bug, I am guessing that this is caused by bug 450833.

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

dvander@hayate:src$ Linux_All_DBG.OBJ/js -j c.js
10 10

WFM in TM branch.  bug 450833 hasn't landed in mozilla-central yet.  You might be seeing bug 458851 (which has only been fixed in mozilla-central as well).

Comment 2

[Wladimir Palant]

I see. Bug 458851 does look very similar - but it was reported a while ago. Did whatever caused it land in mozilla-central in the last three days?

Comment 3

[Brendan Eich [:brendan]]

This is a dup of bug 458851. What changed in m-c three days ago was the JIT being turned on by default for content.

We will sync tm and m-c today.

/be