Do not trace closures in the scope of a With object

RESOLVED WONTFIX

Status

()

RESOLVED WONTFIX
9 years ago
7 years ago

People

(Reporter: jorendorff, Unassigned)

Tracking

Other Branch
Points:
---
Bug Flags:
in-testsuite ?

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

9 years ago
This test passes without -j but fails with -j because at record time, we miss the with-block and read the global x, but at run time we are supposed to hit it. With the JIT, we keep reading the global x, 'ggggggggg'.


var arr = [{}, {}, {}, {}, {}, {}, {}, {}, {}];
var x = 'g';
var f;
with (arr[7]) {
    f = function() { return x; };
}

var b = [];
for (var i = 0; i < 9; i++) {
    arr[i].x = 'w';
    b[i] = f();
}
assertEq(b.join(''), 'gggggggww');
Fixed by the patch for bug 542002, so marking dependency.

/be
Depends on: 542002
Flags: in-testsuite?
(Reporter)

Comment 2

9 years ago
It's not fixed -- this test still fails.

The check added in bug 542002 ("closure scoped by neither the global object nor a Call object") only affects closures created on trace.

And it wouldn't be sufficient anyway, because it's easy to defeat that shallow check:

 with (arr[7]) {
+    (function() {
     f = function() { return x; };
+    })();
 }
Tracer was removed. works with JM + TI.
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.