Closed Bug 470795 Opened 16 years ago Closed 14 years ago

TM: correctness bug due to tracing inside "with" and shadowing after trace is recorded

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: jruderman, Unassigned)

Details

(Keywords: testcase) 

var o = [{},{},{i:42}]
var i;
for (var j = 0; j < 3; ++j) {
  with (o[j]) {
    for (i = 0; i < 2; ++i) {
      print('' + j + ", " + i); 
    } 
  }
}

Output without JIT:
0, 0
0, 1
1, 0
1, 1
2, 0
2, 1

Output with JIT:
0, 0
0, 1
1, 0
1, 1
2, 2
this is fixed now and I added a test:

http://hg.mozilla.org/tracemonkey/rev/a64bb5724b25
Status: NEW → RESOLVED
Closed: 14 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.