As a security precaution, we have turned on the setting "Require API key authentication for API requests" for everyone. If this has broken something, please contact
Last Comment Bug 650076 - JM+TI: incorrect result with testcase involving many variables
: JM+TI: incorrect result with testcase involving many variables
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: general
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: infer-regress
  Show dependency treegraph
Reported: 2011-04-14 12:00 PDT by Jan de Mooij [:jandem]
Modified: 2011-04-14 17:31 PDT (History)
5 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Testcase (342 bytes, application/x-javascript)
2011-04-14 12:01 PDT, Jan de Mooij [:jandem]
no flags Details

Description User image Jan de Mooij [:jandem] 2011-04-14 12:00:58 PDT
$ ./js -n -a -m test.js
test.js:10: TypeError: v1 is undefined

Revision f3acaebac193, 32-bit.
Comment 1 User image Jan de Mooij [:jandem] 2011-04-14 12:01:30 PDT
Created attachment 526067 [details]
Comment 2 User image Brian Hackett (:bhackett) 2011-04-14 17:31:59 PDT
If the global object had its slots reallocated during the middle of compilation (due to the string class being constructed, which adds some properties outside of the standard class slots), we didn't trigger recompilation and the global property addresses baked into the code were invalid.

Note You need to log in before you can comment on or make changes to this bug.