696070 - Jitted float4 component access via numeric index causes a ReferenceError

Status: VERIFIED FIXED

(Tamarin Graveyard :: Baseline JIT (CodegenLIR), defect)

Description

[Brent Baker]

Accessing a float4 component via a numeric index will produce a ReferenceError if the code is jitted, interpreter works fine for this code.

var flt4:float4 = new float4(1f, 2f, 3f, 4f);
print(flt4[0]); // ReferenceError
print(flt4['0']); // this is ok

Comment 1

[Brent Baker]

Testmedia: as3/Types/Float4/flt4_4_6_3.as

Comment 2

[Lars T Hansen]

Looks like missing code in getpropertylate_i as of now.

Of course, if v is known to be float4 then v[0] should be as efficient as v.x, so there's additional work to be done around that.  (I'll put that on the worklist.)

Comment 3

[Lars T Hansen]

Also getpropertylate_u/d, and also haspropertylate_i/u, Toplevel::in_operator, Toplevel::hasproperty.

This pattern is used throughout (but not consistently) and cleverly obscures what's going on without comments about why it is what it is (namely, it assumes primitive values have no dynamic properties and that we can start searching in the prototype):

   const ScriptObject* curObj = AvmCore::isObject(obj) ?
                                  AvmCore::atomToScriptObject(obj) :
                                  toPrototype(obj);

Comment 4

[Brent Baker]

Testmedia renamed to as3/Types/Float4/component_access_numeric_index.as

Comment 5

[Lars T Hansen]

Also constructprop in instr.cpp.

Also call_prim_dynamic in instr-inlines.h.

Comment 6

[Lars T Hansen]

Fixed, though some mop-up work moves to bug #695055.

Comment 7

[Brent Baker]

Fixed in changesets: 
6911:c2158029f98e
6913:20bec0946709

Comment 8

[Tamarin Bot]

changeset: 6978:18119d533fa9
user:      Brent Baker <[e-mail]>
summary:   Update expected failures for bugs 696070 and 703259

http://hg.mozilla.org/tamarin-redux/rev/18119d533fa9