Last Comment Bug 650076 - JM+TI: incorrect result with testcase involving many variables
: JM+TI: incorrect result with testcase involving many variables
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: general
Depends on:
Blocks: infer-regress
  Show dependency treegraph
Reported: 2011-04-14 12:00 PDT by Jan de Mooij [:jandem]
Modified: 2011-04-14 17:31 PDT (History)
5 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Testcase (342 bytes, application/x-javascript)
2011-04-14 12:01 PDT, Jan de Mooij [:jandem]
no flags Details

Description Jan de Mooij [:jandem] 2011-04-14 12:00:58 PDT
$ ./js -n -a -m test.js
test.js:10: TypeError: v1 is undefined

Revision f3acaebac193, 32-bit.
Comment 1 Jan de Mooij [:jandem] 2011-04-14 12:01:30 PDT
Created attachment 526067 [details]
Comment 2 Brian Hackett (:bhackett) 2011-04-14 17:31:59 PDT
If the global object had its slots reallocated during the middle of compilation (due to the string class being constructed, which adds some properties outside of the standard class slots), we didn't trigger recompilation and the global property addresses baked into the code were invalid.

Note You need to log in before you can comment on or make changes to this bug.