Closed
Bug 484104
Opened 15 years ago
Closed 15 years ago
TM: NEWINIT creates objects with a wrong prototype
Categories
(Core :: JavaScript Engine, defect, P1)
Core
JavaScript Engine
Tracking
()
VERIFIED
FIXED
mozilla1.9.2a1
People
(Reporter: gal, Assigned: gal)
Details
(Keywords: testcase, verified1.9.1, Whiteboard: fixed-in-tracemonkey)
Attachments
(1 file)
1.18 KB,
patch
|
mrbkap
:
review+
|
Details | Diff | Splinter Review |
No description provided.
Flags: blocking1.9.1?
Assignee | ||
Comment 1•15 years ago
|
||
Thanks to mrbkap for diagnosing this. Testcase: var a; for (var i = 0; i < 10; ++i) a = {}; print(uneval(a)); No jit: ({}) Jit: x.js:4: TypeError: Function.prototype.toString called on incompatible object
Severity: normal → critical
Priority: -- → P1
Assignee | ||
Updated•15 years ago
|
Assignee: general → gal
Assignee | ||
Comment 2•15 years ago
|
||
Attachment #368157 -
Flags: review?(mrbkap)
Updated•15 years ago
|
Attachment #368157 -
Flags: review?(mrbkap) → review+
Assignee | ||
Comment 3•15 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/d46fb76b5542
Whiteboard: fixed-in-tracemonkey
Comment 4•15 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/d46fb76b5542
Status: NEW → RESOLVED
Closed: 15 years ago
Flags: blocking1.9.1? → blocking1.9.1+
Resolution: --- → FIXED
Comment 5•15 years ago
|
||
How'd that old code ever work?! /be
Comment 6•15 years ago
|
||
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/26484902cce5
Keywords: fixed1.9.1
Comment 7•15 years ago
|
||
Verified fixed with testcase given in comment 1 on trunk and 1.9.1 with the following debug builds: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20090422 Minefield/3.6a1pre ID:20090422224452 Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b4pre) Gecko/20090422 Shiretoko/3.5b4pre ID:20090422122043
Status: RESOLVED → VERIFIED
OS: Mac OS X → All
Hardware: x86 → All
Target Milestone: mozilla1.9.1b4 → mozilla1.9.2a1
Version: unspecified → Trunk
Comment 8•15 years ago
|
||
js1_8_1/trace/trace-test.js http://hg.mozilla.org/tracemonkey/rev/61892f57b46a
Flags: in-testsuite+
Comment 9•15 years ago
|
||
cvsroot/mozilla/js/tests/js1_8_1/trace/trace-test.js,v <-- trace-test.js new revision: 1.14; previous revision: 1.13 /cvsroot/mozilla/js/tests/shell.js,v <-- shell.js
You need to log in
before you can comment on or make changes to this bug.
Description
•