583873 - JM: crashtest unexpected JS exception on editor/libeditor/html/crashtests/467647-1.html

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[David Mandelin [:dmandelin]]

Output is:

WARNING: Not same origin error!: file c:/builds/mo-d/dom/base/../../../../sources/moo/dom/base/nsJSEnvironment.cpp, line 475
JavaScript error: chrome://xbl-marquee/content/xbl-marquee.xml, line 304: this is undefined

It appears we are not syncing the base object for a getelem PIC on the slot path for an expression this["_on" + aName].

Comment 1

[David Mandelin [:dmandelin]]

Attachment: Patch

Comment 2

[David Mandelin [:dmandelin]]

http://hg.mozilla.org/projects/jaegermonkey/rev/c6533f935adf

Comment 3

[Chris Leary [:cdleary] (not checking bugmail)]

Hmmm... not sure I get this. The set of unsync'd registers should have been the same at the two exit points, as I recall from discussion in the getelem PIC bug. 

Maybe time I dove back into the framestate implementation, I've paged some of that stuff out of my head.

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

linkExitDirect() does not generate any spill code. linkExit() is a direct path to wherever you call leave() - it does not fallthrough.

It's a little confusing - every time I try to outsmart linkExit() it gets the better of me. Good indicator that the API should change at some point.