Closed Bug 566637 Opened 14 years ago Closed 14 years ago

TM: "this.a" not updated as global variable "a" changes value

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
major

Tracking

()

RESOLVED FIXED
Tracking Status
blocking2.0 --- final+

People

(Reporter: jruderman, Assigned: jorendorff)

References

Details

(Keywords: regression, testcase, Whiteboard: [fixed-in-tracemonkey])

Attachments

(1 file)

js> for (var j = 0; j < 6; ++j) { var a = j; print(this.a); } 

0
1
2
2
2
2
blocking2.0: --- → final+
Looks like getthisprop doesn't check for the global object. Dumb. We should fix this with a fast path (guard on global object, and then reach into slots).
For this particular script, you can tell statically that |this| is the global object and omit the guard, right?
Yeah, its global code so that should work.
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   40757:c12e3fa489dc
user:        Jason Orendorff
date:        Mon Apr 12 08:27:16 2010 -0500
summary:     Bug 557652 - Eliminate redundant guard that incProp/getProp operand is not the global object. r=brendan.
Blocks: 557652
Keywords: regression
OS: Mac OS X → All
Hardware: x86 → All
... where the first "good" revision means that the number "5" is no longer seen in stdout.
Need an owner -- jorendorff, gal, anyone have time?

/be
My regression. Taking.
Assignee: general → jorendorff
Attached patch v1Splinter Review
Attachment #460343 - Flags: review?(gal)
Attachment #460343 - Flags: review?(gal) → review+
http://hg.mozilla.org/tracemonkey/rev/e0bc614d6ac2
Whiteboard: [fixed-in-tracemonkey]
http://hg.mozilla.org/mozilla-central/rev/e0bc614d6ac2
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Bug in removed tracer code, setting in-testsuite- flag.
Flags: in-testsuite-
You need to log in before you can comment on or make changes to this bug.