The default bug view has changed. See this FAQ.

Method JIT allows assignment to undeclared in ES5 strict mode code

RESOLVED FIXED in mozilla14

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: Jesse Ruderman, Assigned: bhackett)

Tracking

(Blocks: 2 bugs, {regression, testcase})

Trunk
mozilla14
x86_64
Mac OS X
regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
var obj = {valueOf: function() { "use strict"; undeclared = 7; }};
try { '' + obj; print("FAIL 1"); } catch(e) { }
try { '' + obj; print("FAIL 2"); } catch(e) { }
if ("undeclared" in this) print("FAIL 3");


./js           (no output; PASS)
./js -m -a     FAIL 2, FAIL 3
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   81258:f852758f39d1
user:        Brian Hackett
date:        Thu Oct 13 20:21:36 2011 -0700
summary:     Move JSObject::parent to BaseShape, bug 638316.
Blocks: 638316
Keywords: regression
Created attachment 605407 [details] [diff] [review]
patch

autoBisect is wrong, this bug is older.  The PIC generation for ADDPROP wasn't checking for undeclared vars under SETNAME, this patch disables the PIC in such cases.
Assignee: general → bhackett1024
Attachment #605407 - Flags: review?(dvander)
No longer blocks: 638316
Attachment #605407 - Flags: review?(dvander) → review+
https://hg.mozilla.org/integration/mozilla-inbound/rev/9c1d8c86c3cd
https://hg.mozilla.org/mozilla-central/rev/9c1d8c86c3cd
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla14
You need to log in before you can comment on or make changes to this bug.