Closed
Bug 473271
Opened 16 years ago
Closed 16 years ago
TM: nested-closure array indexing problem when setting object properties in loop
Categories
(Core :: JavaScript Engine, defect, P3)
Core
JavaScript Engine
Tracking
()
VERIFIED
DUPLICATE
of bug 452498
People
(Reporter: mozilla+ben, Assigned: brendan)
References
()
Details
(Whiteboard: fixed-in-tracemonkey)
Attachments
(2 files, 1 obsolete file)
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20090112 Minefield/3.2a1pre
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20090112 Minefield/3.2a1pre
See attachment for minimized testcase.
Any of these modifications make the problem disappear:
1. referring to $methodName (or even arguments[0]) in the hello function before returning the howdy closure
2. unrolling the for-loop
3. returning an anonymous function instead of declaring/returning the function named howdy
Reproducible: Always
Steps to Reproduce:
1. Load attached page
2. Note contents of alert message
Actual Results:
Contents are "FAIL"
Expected Results:
Contents should be "HIGH PASS"
Reporter | ||
Comment 1•16 years ago
|
||
Reporter | ||
Updated•16 years ago
|
Component: General → JavaScript Engine
Product: Firefox → Core
Reporter | ||
Updated•16 years ago
|
Version: unspecified → Trunk
Reporter | ||
Comment 2•16 years ago
|
||
Changed the array to [0, 1, 2, 3] because ['EPIC FAIL', 'FAIL', 'PASS', 'HIGH PASS'] was misleading ('PASS' was a failing result, for instance). The expected result is now 3, whereas the latest nightly returns 1.
Attachment #356628 -
Attachment is obsolete: true
Comment 3•16 years ago
|
||
Thanks Ben!
I played around a little more and made an even simpler test case. The bug happens even if the code isn't inside the prototype, and even if there is no array (just a for loop that iterates more than twice).
Comment 4•16 years ago
|
||
"Iterates more than twice" smells like jit bug.
Updated•16 years ago
|
Summary: nested-closure array indexing problem when setting object properties in loop → TM: nested-closure array indexing problem when setting object properties in loop
Comment 5•16 years ago
|
||
Confirmed for TM tip. Great testcase. Thanks.
Status: UNCONFIRMED → NEW
Ever confirmed: true
QA Contact: general → gal
Comment 6•16 years ago
|
||
We have to abort on DEFLOCALFUN if anything is left to capture as we walk past it. The upvar patch (452498) will copy the value into a flat closure for howdy every time. We can't fix this until 452498 is in the bag, so adding a dependency and we will re-visit.
Depends on: upvar2
Comment 7•16 years ago
|
||
Blocking final. I don't think we need a beta for this though. Test case is straight forward.
Severity: normal → major
Flags: blocking1.9.1?
Priority: -- → P3
Assignee | ||
Comment 8•16 years ago
|
||
Shell testcase:
var f = {}, max = 3;
var hello = function(n) {
function howdy() { return n }
f.test = howdy;
};
for (var i = 0; i <= max; i++)
hello(i);
print(f.test() + " (expected " + max + ")");
I have no idea how bad this burns beta testers, but I'm gonna fix for b3.
/be
Updated•16 years ago
|
Flags: blocking1.9.1? → blocking1.9.1+
Comment 9•16 years ago
|
||
Who owns this?
Comment 10•16 years ago
|
||
I will grab it and re-test when brendan lands the upvar patch.
Assignee: nobody → gal
Updated•16 years ago
|
QA Contact: gal → general
Comment 11•16 years ago
|
||
This wfm with the latest upvar patch applied
Assignee | ||
Comment 13•16 years ago
|
||
Added test to tm's trace-test.js:
http://hg.mozilla.org/tracemonkey/rev/0e3f7afa0f0e
/be
Status: NEW → RESOLVED
Closed: 16 years ago
OS: Mac OS X → All
Hardware: x86 → All
Resolution: --- → DUPLICATE
Whiteboard: fixed-in-tracemonkey
Comment 14•15 years ago
|
||
js1_8_1/trace/trace-test.js
http://hg.mozilla.org/tracemonkey/rev/61892f57b46a
Flags: in-testsuite+
Comment 15•15 years ago
|
||
cvsroot/mozilla/js/tests/js1_8_1/trace/trace-test.js,v <-- trace-test.js
new revision: 1.14; previous revision: 1.13
/cvsroot/mozilla/js/tests/shell.js,v <-- shell.js
You need to log in
before you can comment on or make changes to this bug.
Description
•