656538 - Name/property ops differ between function(){...} and new Function("...")

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Related to bug 646597?  This tripped up jsfunfuzz because it used bytecode offsets from one version to trap() the other version.

js> dis(function() { a |= b })
flags: LAMBDA NULL_CLOSURE
main:
00000:  bindgname "a"            <-- "g"
00003:  getgname "a"
00006:  getgname "b"
00009:  bitor
00010:  setgname "a"
00013:  pop
00014:  stop

Source notes:
 ofs  line    pc  delta desc     args
---- ---- ----- ------ -------- ------
  0:    1     9 [   9] xdelta  
  1:    1     9 [   0] assignop

js> dis(new Function("a |= b"))
flags: LAMBDA
main:
00000:  bindname "a"              <-- no "g"
00003:  dup
00004:  getxprop "a"
00007:  name "b"
00010:  bitor
00011:  setname "a"
00014:  pop
00015:  stop

Source notes:
 ofs  line    pc  delta desc     args
---- ---- ----- ------ -------- ------
  0:    2    10 [  10] xdelta  
  1:    2    10 [   0] assignop

Comment 1

[Boris Zbarsky [:bzbarsky]]

Looks an awful lot like bug 639720.

Comment 2

[André Bargull [:anba]]

No longer reproducible - Resolving as WFM.