488050 - upvar2: incorrect optimization of delete function_name

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Igor Bukanov]

In the following code the compiler incorrectly optimizes away "delete f" resulting in the exception thrown when executed in js shell.

(function f()
{
    var callee = f;
    eval('var f = 2');
    if (!delete f)
        throw "Bad delete result";
    if (f != callee)
        throw "Bad value of f";
})();

This is a regression from the bug 452498.

Comment 1

[Igor Bukanov]

Here is another case of the wrong optimization:

(function f()
{
    eval('var f = 2');
    f = (eval('delete f'), 4);
    if (f !== 4)
        throw "Bad bind";
})();

Currently it throws an exception in js shell as f = is optimized away despite the fact that the previous eval hides the original meaning of f.

Comment 2

[Igor Bukanov]

(In reply to comment #1)
> Here is another case of the wrong optimization:
> 

The example can be much simpler without any extra eval:

(function f()
{
    eval('var f = 2');
    f = 0;
    if (f !== 0)
        throw "Bad assign";
})();

Again, it throws currently the exception as f = 0 is optimized away.

Comment 3

[Brendan Eich [:brendan]]

The intention was to deoptimize JSOP_CALLEE due to TCF_FUN_HEAVYWEIGHT, but I did not connect the logic up.

/be

Comment 4

[Brendan Eich [:brendan]]

Attachment: fix

Comment 5

[Brendan Eich [:brendan]]

Patch fixes all testcases in this bug.

/be

Comment 6

[Brendan Eich [:brendan]]

Fixed in tm:

http://hg.mozilla.org/tracemonkey/rev/49643dfd3008

/be

Comment 7

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/49643dfd3008

Comment 8

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/658bca060456