Last Comment Bug 650076 - JM+TI: incorrect result with testcase involving many variables
: JM+TI: incorrect result with testcase involving many variables
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: general
:
Mentors:
Depends on:
Blocks: infer-regress
  Show dependency treegraph
 
Reported: 2011-04-14 12:00 PDT by Jan de Mooij [:jandem] (PTO until July 31)
Modified: 2011-04-14 17:31 PDT (History)
5 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Testcase (342 bytes, application/x-javascript)
2011-04-14 12:01 PDT, Jan de Mooij [:jandem] (PTO until July 31)
no flags Details

Description Jan de Mooij [:jandem] (PTO until July 31) 2011-04-14 12:00:58 PDT
$ ./js -n -a -m test.js
test.js:10: TypeError: v1 is undefined

Revision f3acaebac193, 32-bit.
Comment 1 Jan de Mooij [:jandem] (PTO until July 31) 2011-04-14 12:01:30 PDT
Created attachment 526067 [details]
Testcase
Comment 2 Brian Hackett (:bhackett) 2011-04-14 17:31:59 PDT
If the global object had its slots reallocated during the middle of compilation (due to the string class being constructed, which adds some properties outside of the standard class slots), we didn't trigger recompilation and the global property addresses baked into the code were invalid.

http://hg.mozilla.org/projects/jaegermonkey/rev/f3a11a539c79

Note You need to log in before you can comment on or make changes to this bug.