732693 - Wrong bytecode for o.__proto__()

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

Noticed this yesterday when I was looking at the bytecode emitter for bug 732423.
--
var res = 0;
var o = {__proto__: function() { res++; }};

function f() {
    for (var i=0; i<70; i++) {
        o.__proto__();
    }
}
f();
assertEq(res, 70);
--
This fails with "TypeError: o is not a function", because o.__proto__() is compiled as

00011:  getgname "o"
00016:  qnamepart "__proto__"
00021:  dup
00022:  callelem
00023:  swap
00024:  swap
00025:  call 0
00028:  pop

2 problems here:

1) DUP should be emitted *before* the QNAMEPART
2) SWAP is emitted twice (by EmitElemOpBase and EmitSpecialPropOp)

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Patch

Comment 2

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/55e360715d76

Comment 3

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/55e360715d76