545446 - Do not trace closures in the scope of a With object

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Jason Orendorff [:jorendorff]]

This test passes without -j but fails with -j because at record time, we miss the with-block and read the global x, but at run time we are supposed to hit it. With the JIT, we keep reading the global x, 'ggggggggg'.


var arr = [{}, {}, {}, {}, {}, {}, {}, {}, {}];
var x = 'g';
var f;
with (arr[7]) {
    f = function() { return x; };
}

var b = [];
for (var i = 0; i < 9; i++) {
    arr[i].x = 'w';
    b[i] = f();
}
assertEq(b.join(''), 'gggggggww');

Comment 1

[Brendan Eich [:brendan]]

Fixed by the patch for bug 542002, so marking dependency.

/be

Comment 2

[Jason Orendorff [:jorendorff]]

It's not fixed -- this test still fails.

The check added in bug 542002 ("closure scoped by neither the global object nor a Call object") only affects closures created on trace.

And it wouldn't be sufficient anyway, because it's easy to defeat that shallow check:

 with (arr[7]) {
+    (function() {
     f = function() { return x; };
+    })();
 }

Comment 3

[Tom S]

Tracer was removed. works with JM + TI.