479140 - TM: GETELEM on trace can read a stale global property via the prototype chain

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Jason Orendorff [:jorendorff]]

prop = ['n', 'n', 'n', 'n', 'n', 'n', 'n', 'x'];
g = {__proto__: this, n: 100};
t = 0;
for (x = 0; x < 8; x++)
    t += g[prop[x]];
print(t);


Without -j, prints 707.
With -j, prints 704.  It's reading globalObj.x from the global object itself, which is stale while we're on trace.

(I expected 702 or so.  But the trace is type-unstable the first time it's recorded.  Int-float mismatch, because unbox_jsval always treats numbers as floats.)

Comment 1

[Ryan VanderMeulen [:RyanVM]]

Obsolete with the removal of tracejit.

(As expected, Interp, JM, JM+TI, and d8 all return 707)