Closed
Bug 650076
Opened 15 years ago
Closed 15 years ago
JM+TI: incorrect result with testcase involving many variables
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: jandem, Unassigned)
References
Details
Attachments
(1 file)
|
342 bytes,
application/x-javascript
|
Details |
$ ./js -n -a -m test.js
test.js:10: TypeError: v1 is undefined
Revision f3acaebac193, 32-bit.
|
Reporter | |
Comment 1•15 years ago
|
||
|
||
Comment 2•15 years ago
|
||
If the global object had its slots reallocated during the middle of compilation (due to the string class being constructed, which adds some properties outside of the standard class slots), we didn't trigger recompilation and the global property addresses baked into the code were invalid.
http://hg.mozilla.org/projects/jaegermonkey/rev/f3a11a539c79
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•