The default bug view has changed. See this FAQ.

JM+TI: incorrect result with testcase involving many variables

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: jandem, Unassigned)

Tracking

(Blocks: 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

342 bytes, application/x-javascript
Details
(Reporter)

Description

6 years ago
$ ./js -n -a -m test.js
test.js:10: TypeError: v1 is undefined

Revision f3acaebac193, 32-bit.
(Reporter)

Comment 1

6 years ago
Created attachment 526067 [details]
Testcase
If the global object had its slots reallocated during the middle of compilation (due to the string class being constructed, which adds some properties outside of the standard class slots), we didn't trigger recompilation and the global property addresses baked into the code were invalid.

http://hg.mozilla.org/projects/jaegermonkey/rev/f3a11a539c79
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.