Last Comment Bug 632029 - Reflect.parse incorrectly optimizes away comprehensions containing `if (false)`
: Reflect.parse incorrectly optimizes away comprehensions containing `if (false)`
reflect-parse fixed-in-tracemonkey
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: All All
-- normal (vote)
: ---
Assigned To: general
: Jason Orendorff [:jorendorff]
Depends on: 571617
  Show dependency treegraph
Reported: 2011-02-07 07:32 PST by Jason Orendorff [:jorendorff]
Modified: 2011-06-27 15:15 PDT (History)
2 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Description User image Jason Orendorff [:jorendorff] 2011-02-07 07:32:15 PST
js> Reflect.parse('[x for each (x in y) if (false)]', {loc: false}).body[0].expression
({loc:null, type:"ArrayExpression", elements:[]})

This might look like legitimate constant folding. But the difference is
observable if y has any enumerable properties with getters. This is a
surprising bug, since the engine itself does *not* perform this unsound
Comment 1 User image Dave Herman [:dherman] 2011-06-07 00:09:38 PDT
This one also appears to just go away with the patch for bug 571617.

Comment 2 User image Dave Herman [:dherman] 2011-06-23 00:33:35 PDT
Fixed automatically by fix for bug 571617. Landed a test:

Comment 3 User image Chris Leary [:cdleary] (not checking bugmail) 2011-06-27 11:40:24 PDT
cdleary-bot mozilla-central merge info:
Note: not marking as fixed because fixed-in-tracemonkey is not present on the whiteboard.

Note You need to log in before you can comment on or make changes to this bug.