478186 - [Instruction set] HASNEXT2 has wrong semantics, or it needs help

Status: RESOLVED WONTFIX

(Tamarin Graveyard :: Virtual Machine, defect)

Description

[Lars T Hansen]

Arguably the instruction HASNEXT2 has the wrong semantics.  There are two items.

Current semantics: Given registers holding an object and an integer index, it tests whether there is a property at offset 'index' in 'object', moving to the object's prototype if necessary, and updating the registers as necessary to point to new objects and new offsets, and yielding true or false on the stack.

(1) No filtering of property names

The operator does not perform filtering of property names as required by ECMAScript 3, leading to wrong results.  For example,

    var o1 = { x: 10 }
    function O2() {
        this.x = 20;
    }
    O2.prototype = o1;
    var o2 = new O2;
    for ( var i in o2 )
        print(i + " " + o2[i]);

prints

    x 20
    x 20

when the ES3 answer would be only the first of those lines.

One could argue that the compiler should insert the necessary filtering code here, and that HASNEXT2 is fine the way it is.  This is possible.  In that case I would argue that we should at least prototype the effect of packaging the filtering as a pair of instructions, PUSHNAMEFILTER and FILTERNEXT2, which the compiler could use to generate good code for the loop.

(2) The 'index' register is required to be int

Requiring a bona fide 'int' introduces a number of problems in the code generator, as a consequence of the type merge algorithm in the verifier.  When the type merge algorithm is fixed these problems will go away; even so it's not clear that we gain a lot by requiring the register to be 'int'.  The instruction should be able to convert; we have a lot of instructions that perform conversions already.

Comment 1

[Sylvestre Ledru [:Sylvestre]]

Tamarin is a dead project now. Mass WONTFIX.

Comment 2

[Sylvestre Ledru [:Sylvestre]]

Tamarin isn't maintained anymore. WONTFIX remaining bugs.