645164 - Early binding on int/uint might be different in interpreter vs jit

Status: RESOLVED WONTFIX

(Tamarin Graveyard :: Baseline JIT (CodegenLIR), defect, P3)

Description

[Edwin Smith]

I'm writing this up so we don't forget to test it, but I haven't confirmed it is actually a problem yet.

The verifier determines that some values are type int, (or uint), and this determination can cause early binding to happen.  However, there are really no values in AS3 (or as Atom) that are manifest 'int' typed values -- ints really are just Numbers that have a valid int32 representation.

test case:

int.prototype.whoami = function() { return 'int' }
Number.prototype.whoami = function() { return 'Number' }

function f(x) {
  print((x/3).whoami()) // expression type checks as Number
  print((x&3).whoami()) // expression type checks as int
}

- Does the JIT ever print 'int'?
- would the interpreter always print Number?

If there are any instance methods on int or uint that behave differently than the corresponding methods on Number, then early binding could make the difference be an interpreter/jit inconsistency.

Likewise, if the set of instance properties on int/uint/Number differ in any way (maybe one has a method the other ones dont, or any one method acts differently than the one on Number), then that also might be detectable.

Comment 1

[Sylvestre Ledru [:Sylvestre]]

Tamarin is a dead project now. Mass WONTFIX.

Comment 2

[Sylvestre Ledru [:Sylvestre]]

Tamarin isn't maintained anymore. WONTFIX remaining bugs.