470584 - TM: Function.call() doesn't set "this" correctly

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Wladimir Palant]

An Adblock Plus testcase fails in 20081220 build both in Shiretoko and Minefield, I get "this.regexp is undefined" exception. This is thrown in filterClasses.js line 381 (http://hg.mozdev.org/adblockplus/file/9647dfba2b24/src/chrome/content/filterClasses.js#l381) - this.regexp simply cannot be undefined because it is defined in prototype (and redefined for all instances of the class). Switching off JIT makes the testcase run correctly. Minimal changes to the code (e.g. calling this.regexp.toString() or accessing this.text before that line) also make the testcase run correctly. Given that behavior, I am not quite sure how to minimize the testcase.

Comment 1

[Wladimir Palant]

Figured out that "this" isn't pointing to the object here - it is pointing to the serialize() method itself. Caller is this code:

  RegExpFilter.prototype.serialize.call(this, buffer);

Verified that "this" is correct in the caller. Using Function.apply() instead of Function.call() doesn't change anything.

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Wladimir, can you still reproduce this with the latest tracemonkey build?

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

This might have been fixed by bug 465214 on tracemonkey (waiting to merge back to mozilla-central).

Comment 4

[Wladimir Palant]

Yes, tracemonkey nightly 2008122219 works fine, no more failing testcases.

Comment 5

[Wladimir Palant]

WORKSFORME in 20090107 Minefield and Shiretoko builds, probably fixed by bug 465214.