Closed Bug 690292 Opened 9 years ago Closed 9 years ago

JM: Different output with testcase involving E4X with and without -m, -a and -n

Categories

(Core :: JavaScript Engine, defect, critical)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla10

People

(Reporter: gkw, Assigned: bhackett1024)

Details

(Keywords: testcase, Whiteboard: js-triage-needed)

Attachments

(1 file)

try {
    function x() {}
    print(this.watch("d", Object.create))
    var d = <x></x>
} catch (e) {}
try {
eval("d = ''")
print(<y><z/></y>)
} catch (e) {}


$ ./js-dbg-64-jm-darwin testcase.js 
undefined
$ ./js-dbg-64-jm-darwin -m -a -n testcase.js 
undefined
<y>
  <z/>
</y>

Tested on rev 44ef245b8706, 64-bit Mac OS X 10.6 js shell.
Also occurs on 32-bit Mac m-c rev dbb129f069b1.
Attached patch patchSplinter Review
Accesses on properties with watchpoints were being optimized, where the optimizations bypassed the watchpoint handler.  The intent here was to mark watched type properties as configured (as if they had been turned into a setter, made read-only, etc.), which inhibits optimizations on them.  This was done for properties watched on objects with non-singleton types, but when lazily generating type properties for singleton objects the watchpoints were not taken into account.
Assignee: general → bhackett1024
Attachment #565106 - Flags: review?(luke)
Attachment #565106 - Flags: review?(luke) → review+
https://hg.mozilla.org/mozilla-central/rev/6d74d14dc47c
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla10
You need to log in before you can comment on or make changes to this bug.