625377 - JM: incorrect output for testcase involving for..in, delete

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

Attachment: Testcase

The attached testcase should print:
onetwo
onetwo
onetwo

./js -m (32-bit OS X):
onetwo
onetwoundefined
onetwoundefined

Uncommenting the gc() call fixes it. Seems related to bug 618614.

Comment 1

[Jan de Mooij [:jandem]]

Here's a simpler testcase:
---
for(var i=0; i<3; i++) {
    var obj = { first: "first", second: "second" };
    var count = 0;
    for (var elem in obj) {
        delete obj.second;
        count++;
    }
    print(count);
}
---
This should print: 
1
1
1

Output with -m (32-bit OS X):
1
2
2

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Easy bug. The method JIT is not updating ni->obj so property deletion suppression doesn't fix up the iterator. We had a similar bug for the interpreter.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

This patch also cleans up some really old code and assumptions (like, assuming that iterators won't work on X64 - 3% SunSpider win).

Comment 4

[Luke Wagner [:luke]]

Comment on attachment 503553 [details] [diff] [review]
fix

Nice

Comment 5

[Brendan Eich [:brendan]]

Whew! Nice ifdef reduction.

/be

Comment 6

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/tracemonkey/rev/7b3e7428113c

Comment 7

[Jan de Mooij [:jandem]]

http://hg.mozilla.org/mozilla-central/rev/7b3e7428113c