601454 - Incorrect error message from Object.getPrototypeOf.call on trace

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

var omgthis = {};
var x;
for (let j = 0; j < tracemonkey.HOTLOOP + 1; ++j) {
    try {
        Object.getPrototypeOf.call(omgthis, x);
        print("FAIL: should have thrown");
    } catch (e) {
        if (e.message != "x is not an object") {
            print("FAIL: on iteration " + j + ", threw '" + e.message + "'.");
        }
    }
}

Comment 1

[Jesse Ruderman]

The first bad revision is:
changeset:   4aa8c66fe634
user:        Luke Wagner
date:        Mon Aug 09 14:07:27 2010 -0700
summary:     Bug 581900 - obj_getPrototypeOf produces wrong error when Invoked (r=brendan)

Is this the same as bug 585692?

Comment 2

[Luke Wagner [:luke]]

Bug 585692 would definitely improve things, but I'm confused why this particular example is going wrong.  I am seeing js_DecompileValueGenerator identify the stack offset of the 'x' parameter to 'call' (matching the value 'undefined') as 3 and pcstack[3] correctly points to JSOP_GETGLOBAL 'x', which is passed into DecompileExpression.

Comment 3

[Luke Wagner [:luke]]

Disregard comment 2, that was walking through iteration 1, whereas the error happens when recording.  The bug is with JSDVG_SEARCH_STACK + imacros: although there is some code trying to deal with imacros in the decompiler, js_DecompileValueGenerator circumvents it and acts as if there is no imacro.  Thus, it finds the value of 'x' on the stack where the imacro placed it by asks "who generated this value" as if there was no imacro.

The reason this worked without JSDVG_SEARCH_STACK is that the caller also did not expect imacros and thus passed an incorrect spindex that matched the decompilers incorrect lookup mechanism.

Comment 4

[Tom S [:evilpie]]

tracer was removed, works with other jit flag combinations.