470173 - TM: "with" allows jitted code to overwrite consts

Status: RESOLVED DUPLICATE of bug 470176

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

const nine = 9; with({}) { for (b=0;b<5;++b) ++nine; } print('' + nine);

interpreter:   9
jit:          12

I think the JIT shouldn't be triggered at all, since the loop is inside a "with" block.

Comment 1

[Brendan Eich [:brendan]]

We don't trace JSOP_ENTERWITH or JSOP_LEAVEWITH but they're not in the loop here. Loops are traced, not whole programs or methods.

The patch for bug 465443 should have fixed this.

/be

Comment 2

[Graydon Hoare :graydon]

Pushed to tracemonkey in revision 0ceae28c4c55, as fix for bug 470176 (duplicate).