476066 - trap() on getxprop changes behavior of "a += 1"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

js> f = function () { return a += 1; }
function () {
    return a += 1;
}

js> dis(f);
flags: LAMBDA INTERPRETED
main:
00000:  bindname "a"
00003:  dup
00004:  getxprop "a"    <-- trap is going to go here
00007:  one
00008:  add
00009:  setname "a"
00012:  return
00013:  stop

Source notes:
  0:     8 [   8] xdelta  
  1:     8 [   0] assignop

js> f();
typein:1: ReferenceError: reference to undefined property "a"

js> trap(f,4,'');

js> f();
NaN

Comment 1

[Jason Orendorff [:jorendorff]]

function f() { a += 1; }
trap(f, 4, '');
try {
  f();
  print('FAIL');
} catch (e) {
  print('PASS');
}

The patch in bug 463239 fixes this.

Comment 2

[Jesse Ruderman]

Yep, this is fixed.