JM: incorrect output for testcase involving for..in, delete

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
8 years ago
8 years ago

People

(Reporter: jandem, Assigned: dvander)

Tracking

({regression, testcase})

unspecified
x86
Mac OS X
regression, testcase
Points:
---

Firefox Tracking Flags

(blocking2.0 final+)

Details

(Whiteboard: [hardblocker][fixed-in-tracemonkey])

Attachments

(2 attachments)

(Reporter)

Description

8 years ago
Created attachment 503497 [details]
Testcase

The attached testcase should print:
onetwo
onetwo
onetwo

./js -m (32-bit OS X):
onetwo
onetwoundefined
onetwoundefined

Uncommenting the gc() call fixes it. Seems related to bug 618614.
(Reporter)

Updated

8 years ago
blocking2.0: --- → ?
Keywords: regression, testcase
(Reporter)

Comment 1

8 years ago
Here's a simpler testcase:
---
for(var i=0; i<3; i++) {
    var obj = { first: "first", second: "second" };
    var count = 0;
    for (var elem in obj) {
        delete obj.second;
        count++;
    }
    print(count);
}
---
This should print: 
1
1
1

Output with -m (32-bit OS X):
1
2
2
Assignee: general → dvander
Status: NEW → ASSIGNED
Easy bug. The method JIT is not updating ni->obj so property deletion suppression doesn't fix up the iterator. We had a similar bug for the interpreter.
blocking2.0: ? → final+
Created attachment 503553 [details] [diff] [review]
fix

This patch also cleans up some really old code and assumptions (like, assuming that iterators won't work on X64 - 3% SunSpider win).
Attachment #503553 - Flags: review?(lw)
Whiteboard: hardblocker
Comment on attachment 503553 [details] [diff] [review]
fix

Nice
Attachment #503553 - Flags: review?(lw) → review+
Whew! Nice ifdef reduction.

/be
http://hg.mozilla.org/tracemonkey/rev/7b3e7428113c
Whiteboard: hardblocker → [hardblocker][fixed-in-tracemonkey]
(Reporter)

Comment 7

8 years ago
http://hg.mozilla.org/mozilla-central/rev/7b3e7428113c
Status: ASSIGNED → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.