Closed Bug 592412 Opened 14 years ago Closed 14 years ago

TM: wrong behavior setting existing properties to joined function object values

Categories

(Core :: JavaScript Engine, defect, P1)

defect

Tracking

()

RESOLVED FIXED
mozilla2.0
Tracking Status
blocking2.0 --- betaN+

People

(Reporter: bhackett1024, Assigned: brendan)

References

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

For this testcase:

function f() {
  var a = [{m: 0}, {m: 1}];
  var b = [{}, {}];
  for (var i = 0; i < 2; i++) {
    a[i].m = function() { return 0; };
    b[i].m = function() { return 1; };
  }
  print(a[0].m == a[1].m);
  print(b[0].m == b[1].m);
}
f();

I get this output from TM/JM:

true
false

I think that both equalities should be false.
Assignee: general → brendan
blocking2.0: --- → ?
Priority: -- → P1
Target Milestone: --- → mozilla2.0
Status: NEW → ASSIGNED
Blocks: 471214
Attached patch proposed fixSplinter Review
Trying to keep joining function objects is tough. If the pre-existing property is a writable data property, then we could try reshaping it to have the METHOD flag. That means forking the shape tree or going to dictionary mode. This patch instead keeps things relatively simple by giving up and unjoining (cloning) unless the pre-existing shape is already a method.

/be
Attachment #470971 - Flags: review?(jorendorff)
Blocks: 561506
Summary: TM: wrong behavior setting existing properties with function objects → TM: wrong behavior setting existing properties to function object values
Summary: TM: wrong behavior setting existing properties to function object values → TM: wrong behavior setting existing properties to joined function object values
Comment on attachment 470971 [details] [diff] [review]
proposed fix

As much as it hurts to make this function any more complicated than it already is, this seems just right.
Attachment #470971 - Flags: review?(jorendorff) → review+
http://hg.mozilla.org/tracemonkey/rev/a94f533cf703

/be
Whiteboard: fixed-in-tracemonkey
blocking2.0: ? → betaN+
http://hg.mozilla.org/mozilla-central/rev/a94f533cf703

/be
Status: ASSIGNED → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.