Closed Bug 732693 Opened 8 years ago Closed 8 years ago

Wrong bytecode for o.__proto__()

Categories

(Core :: JavaScript Engine, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla13

People

(Reporter: jandem, Assigned: jandem)

References

Details

Attachments

(1 file)

Noticed this yesterday when I was looking at the bytecode emitter for bug 732423.
--
var res = 0;
var o = {__proto__: function() { res++; }};

function f() {
    for (var i=0; i<70; i++) {
        o.__proto__();
    }
}
f();
assertEq(res, 70);
--
This fails with "TypeError: o is not a function", because o.__proto__() is compiled as

00011:  getgname "o"
00016:  qnamepart "__proto__"
00021:  dup
00022:  callelem
00023:  swap
00024:  swap
00025:  call 0
00028:  pop

2 problems here:

1) DUP should be emitted *before* the QNAMEPART
2) SWAP is emitted twice (by EmitElemOpBase and EmitSpecialPropOp)
Attached patch PatchSplinter Review
Attachment #602602 - Flags: review?(bhackett1024)
Attachment #602602 - Flags: review?(bhackett1024) → review+
https://hg.mozilla.org/mozilla-central/rev/55e360715d76
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.