Last Comment Bug 632029 - Reflect.parse incorrectly optimizes away comprehensions containing `if (false)`
: Reflect.parse incorrectly optimizes away comprehensions containing `if (false)`
Status: RESOLVED FIXED
reflect-parse fixed-in-tracemonkey
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: All All
: -- normal (vote)
: ---
Assigned To: general
:
Mentors:
Depends on: 571617
Blocks:
  Show dependency treegraph
 
Reported: 2011-02-07 07:32 PST by Jason Orendorff [:jorendorff]
Modified: 2011-06-27 15:15 PDT (History)
2 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Jason Orendorff [:jorendorff] 2011-02-07 07:32:15 PST
js> Reflect.parse('[x for each (x in y) if (false)]', {loc: false}).body[0].expression
({loc:null, type:"ArrayExpression", elements:[]})

This might look like legitimate constant folding. But the difference is
observable if y has any enumerable properties with getters. This is a
surprising bug, since the engine itself does *not* perform this unsound
optimization.
Comment 1 Dave Herman [:dherman] 2011-06-07 00:09:38 PDT
This one also appears to just go away with the patch for bug 571617.

Dave
Comment 2 Dave Herman [:dherman] 2011-06-23 00:33:35 PDT
Fixed automatically by fix for bug 571617. Landed a test:

http://hg.mozilla.org/tracemonkey/rev/32093cf27f2e

Dave
Comment 3 Chris Leary [:cdleary] (not checking bugmail) 2011-06-27 11:40:24 PDT
cdleary-bot mozilla-central merge info:
http://hg.mozilla.org/mozilla-central/rev/32093cf27f2e
Note: not marking as fixed because fixed-in-tracemonkey is not present on the whiteboard.

Note You need to log in before you can comment on or make changes to this bug.