Method JIT allows assignment to undeclared in ES5 strict mode code

RESOLVED FIXED in mozilla14

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: Jesse Ruderman, Assigned: bhackett)

Tracking

(Blocks: 2 bugs, {regression, testcase})

Trunk
mozilla14
x86_64
Mac OS X
regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
var obj = {valueOf: function() { "use strict"; undeclared = 7; }};
try { '' + obj; print("FAIL 1"); } catch(e) { }
try { '' + obj; print("FAIL 2"); } catch(e) { }
if ("undeclared" in this) print("FAIL 3");


./js           (no output; PASS)
./js -m -a     FAIL 2, FAIL 3
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   81258:f852758f39d1
user:        Brian Hackett
date:        Thu Oct 13 20:21:36 2011 -0700
summary:     Move JSObject::parent to BaseShape, bug 638316.
Blocks: 638316
Keywords: regression
(Assignee)

Comment 2

5 years ago
Created attachment 605407 [details] [diff] [review]
patch

autoBisect is wrong, this bug is older.  The PIC generation for ADDPROP wasn't checking for undeclared vars under SETNAME, this patch disables the PIC in such cases.
Assignee: general → bhackett1024
Attachment #605407 - Flags: review?(dvander)
No longer blocks: 638316
Attachment #605407 - Flags: review?(dvander) → review+
(Assignee)

Comment 3

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/9c1d8c86c3cd
https://hg.mozilla.org/mozilla-central/rev/9c1d8c86c3cd
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla14
You need to log in before you can comment on or make changes to this bug.