Closed Bug 488050 Opened 11 years ago Closed 11 years ago

upvar2: incorrect optimization of delete function_name

Categories

(Core :: JavaScript Engine, defect, P2)

defect

Tracking

()

RESOLVED FIXED
mozilla1.9.1b4

People

(Reporter: igor, Assigned: brendan)

References

Details

(Keywords: fixed1.9.1, regression, testcase, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

In the following code the compiler incorrectly optimizes away "delete f" resulting in the exception thrown when executed in js shell.

(function f()
{
    var callee = f;
    eval('var f = 2');
    if (!delete f)
        throw "Bad delete result";
    if (f != callee)
        throw "Bad value of f";
})();

This is a regression from the bug 452498.
Flags: blocking1.9.1?
Here is another case of the wrong optimization:

(function f()
{
    eval('var f = 2');
    f = (eval('delete f'), 4);
    if (f !== 4)
        throw "Bad bind";
})();

Currently it throws an exception in js shell as f = is optimized away despite the fact that the previous eval hides the original meaning of f.
(In reply to comment #1)
> Here is another case of the wrong optimization:
> 

The example can be much simpler without any extra eval:

(function f()
{
    eval('var f = 2');
    f = 0;
    if (f !== 0)
        throw "Bad assign";
})();

Again, it throws currently the exception as f = 0 is optimized away.
The intention was to deoptimize JSOP_CALLEE due to TCF_FUN_HEAVYWEIGHT, but I did not connect the logic up.

/be
Assignee: general → brendan
Status: NEW → ASSIGNED
Priority: -- → P2
Target Milestone: --- → mozilla1.9.1b4
Flags: blocking1.9.1? → blocking1.9.1+
Attached patch fixSplinter Review
Attachment #372499 - Flags: review?(igor)
Patch fixes all testcases in this bug.

/be
Flags: in-testsuite?
Attachment #372499 - Flags: review?(igor) → review+
Fixed in tm:

http://hg.mozilla.org/tracemonkey/rev/49643dfd3008

/be
Whiteboard: fixed-in-tracemonkey
http://hg.mozilla.org/mozilla-central/rev/49643dfd3008
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.