JM: Different output with testcase involving E4X with and without -m, -a and -n

RESOLVED FIXED in mozilla10

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: gkw, Assigned: bhackett)

Tracking

(Blocks: 2 bugs, {testcase})

Trunk
mozilla10
x86
Mac OS X
testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: js-triage-needed)

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
try {
    function x() {}
    print(this.watch("d", Object.create))
    var d = <x></x>
} catch (e) {}
try {
eval("d = ''")
print(<y><z/></y>)
} catch (e) {}


$ ./js-dbg-64-jm-darwin testcase.js 
undefined
$ ./js-dbg-64-jm-darwin -m -a -n testcase.js 
undefined
<y>
  <z/>
</y>

Tested on rev 44ef245b8706, 64-bit Mac OS X 10.6 js shell.
(Reporter)

Comment 1

6 years ago
Also occurs on 32-bit Mac m-c rev dbb129f069b1.
(Assignee)

Comment 2

6 years ago
Created attachment 565106 [details] [diff] [review]
patch

Accesses on properties with watchpoints were being optimized, where the optimizations bypassed the watchpoint handler.  The intent here was to mark watched type properties as configured (as if they had been turned into a setter, made read-only, etc.), which inhibits optimizations on them.  This was done for properties watched on objects with non-singleton types, but when lazily generating type properties for singleton objects the watchpoints were not taken into account.
Assignee: general → bhackett1024
Attachment #565106 - Flags: review?(luke)

Updated

6 years ago
Attachment #565106 - Flags: review?(luke) → review+
(Assignee)

Comment 3

6 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/6d74d14dc47c

Comment 4

6 years ago
https://hg.mozilla.org/mozilla-central/rev/6d74d14dc47c
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla10
You need to log in before you can comment on or make changes to this bug.