465132 - TM: Mathematical constants aren't

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Jesse Ruderman]

js> for(i=0;i<9;++i) print("" + (++Math.PI))
4.141592653589793
4.141592653589793
4.141592653589793
5.141592653589793
6.141592653589793
7.141592653589793
8.141592653589793
9.141592653589793
10.141592653589793

Comment 1

[Andreas Gal :gal]

Confirmed. I don't think this is a blocker for b2.

Comment 2

[Brendan Eich [:brendan]]

It's a release blocker though -- readonly is important for certain DOM integrity properties.

/be

Comment 3

[Graydon Hoare :graydon]

It's worse than just "surprising behavior" or "bad integrity"; it causes the interpreter's and tracer's view of what's in a slot to diverge. As far as I can tell anyway (which is still rather murky), this is what's causing the crash in bug 465443. At bare minimum we should cleanly abort recording when we see a const, and revisit this later (perhaps when the ES-* process actually defines const sensibly?)

Comment 4

[Graydon Hoare :graydon]

Oh, duh .. here we have "Math.PI", not even a declared "const". So it's not exactly the same bug. 

We should still (IMO) just bail off the trace when we see a write to anything JSPROP_READONLY. Or simulate the write along the lines of what the interp does, eventually.

Comment 5

[Graydon Hoare :graydon]

Fixed via patch to bug 465443, pushed to tracemonkey in revision ed2062a1593c.

Comment 6

[Graydon Hoare :graydon]

As it was part of the fix for bug 465443, this landed on 1.9.1:

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/dd786c2ce1ed

Comment 7

[Bob Clary [:bc] (inactive)]

Checking in js1_5/Regress/regress-465132.js
http://hg.mozilla.org/mozilla-central/rev/2fb5559e56e2

Comment 8

[Bob Clary [:bc] (inactive)]

v 1.9.1, 1.9.2