581223 - let blocks in loops behave differently when tracing JIT is enabled

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Wesley W. Garland]

Attachment: Short test case

I was playing with let blocks and found some really wacky behaviour.  When I made a let block inside a for(let loop, and tried to use the loop iterator inside this new let block, it works 2 or 3 times  (usually 2) and then claims that the inner let variable is undefined.

I've repro'd on x86/Leopard with an old build (May 2010) and a fairly recent Tracemonkey, and also on sparc. My sparc tracemonkey is at the revision right before fatvals landed.

The test program I'm attaching should count from 0 to 9.  When the JIT is disabled, it does.  When the JIT is enabled, it counts to 0 and 1, and sometimes 2, before throwing 'j is not defined'.

Comment 1

[Dan Shoutis]

This bug is possibly related. It evidences the same behaviour, although in a much longer test case, of a closed-over value becoming undefined (JIT only): 

https://bugzilla.mozilla.org/show_bug.cgi?id=583757

Comment 2

[Nicholas Nethercote [inactive]]

I don't suppose the landing of the patch for bug 582766 has fixed this?  It fixed some problems with tracing 'let'.