648708 - TI: Different output with testcase with and without -m, -a and -n

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: potential regression window

try {
    ("".x = Object.seal)
    "".x.valueOf();
    print("FOOBAR")
} catch (e) {}

prints "FOOBAR" with -m, -a and -n on JM changeset a9f916668b29, but does not print it without -m, -a and -n set. This difference in behaviour has a (not-so-small) regression window as attached.

Comment 1

[Brian Hackett [Laid off!]]

Busted path when CALLPROP is known to push a singleton but the operand is not known to be an object.  We emitted a test to check for an object, but the sync code reflected the state *after* doing the operation itself, so that the stub call saw the singleton result of the operation rather than an undefined value, and thus didn't throw.  Should have added a test when I added this object test.

http://hg.mozilla.org/projects/jaegermonkey/rev/5469f5d077ac