Closed
Bug 484104
Opened 15 years ago
Closed 15 years ago
TM: NEWINIT creates objects with a wrong prototype
Categories
(Core :: JavaScript Engine, defect, P1)
Core
JavaScript Engine
Tracking
()
VERIFIED
FIXED
mozilla1.9.2a1
People
(Reporter: gal, Assigned: gal)
Details
(Keywords: testcase, verified1.9.1, Whiteboard: fixed-in-tracemonkey)
Attachments
(1 file)
|
1.18 KB,
patch
|
mrbkap
:
review+
|
Details | Diff | Splinter Review |
No description provided.Flags: blocking1.9.1?
|
Assignee | |
Comment 1•15 years ago
|
||
Thanks to mrbkap for diagnosing this.
Testcase:
var a;
for (var i = 0; i < 10; ++i)
a = {};
print(uneval(a));
No jit:
({})
Jit:
x.js:4: TypeError: Function.prototype.toString called on incompatible objectSeverity: normal → critical
Priority: -- → P1
|
|
Assignee | |
Updated•15 years ago
|
Assignee: general → gal
|
|
Assignee | |
Comment 2•15 years ago
|
||
Attachment #368157 -
Flags: review?(mrbkap)
|
||
Updated•15 years ago
|
Attachment #368157 -
Flags: review?(mrbkap) → review+
|
|
Assignee | |
Comment 3•15 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/d46fb76b5542
Whiteboard: fixed-in-tracemonkey
|
||
Comment 4•15 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/d46fb76b5542
Status: NEW → RESOLVED
Closed: 15 years ago
Flags: blocking1.9.1? → blocking1.9.1+
Resolution: --- → FIXED
|
||
Comment 5•15 years ago
|
||
How'd that old code ever work?! /be
|
||
Comment 6•15 years ago
|
||
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/26484902cce5
Keywords: fixed1.9.1
|
||
Comment 7•15 years ago
|
||
Verified fixed with testcase given in comment 1 on trunk and 1.9.1 with the following debug builds: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20090422 Minefield/3.6a1pre ID:20090422224452 Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b4pre) Gecko/20090422 Shiretoko/3.5b4pre ID:20090422122043
Status: RESOLVED → VERIFIED
OS: Mac OS X → All
Hardware: x86 → All
Target Milestone: mozilla1.9.1b4 → mozilla1.9.2a1
Version: unspecified → Trunk
|
||
Comment 8•15 years ago
|
||
js1_8_1/trace/trace-test.js http://hg.mozilla.org/tracemonkey/rev/61892f57b46a
Flags: in-testsuite+
|
|
||
Comment 9•15 years ago
|
||
cvsroot/mozilla/js/tests/js1_8_1/trace/trace-test.js,v <-- trace-test.js new revision: 1.14; previous revision: 1.13 /cvsroot/mozilla/js/tests/shell.js,v <-- shell.js
You need to log in
before you can comment on or make changes to this bug.
Description
•