Closed
Bug 758543
Opened 12 years ago
Closed 12 years ago
IonMonkey: Differential Testing: Missing ReferenceError with __proto__ and ion
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: decoder, Assigned: dvander)
References
Details
(Keywords: regression, testcase, Whiteboard: [fuzzblocker])
Attachments
(1 file)
1.46 KB,
patch
|
sstangl
:
review+
|
Details | Diff | Splinter Review |
The following testcase shows different behavior with options --ion -n -m --ion-eager vs. --no-ion on ionmonkey revision c05b873dad48: y = this.watch("x", function() { var result = x * obj; }); var save__proto__ = __proto__; __proto__ = save__proto__; evaluate("{ function x() {} }"); evaluate("var x = {};"); $ debug64/js --ion -n -m --ion-eager test.js <no output or error> $ debug64/js --no-ion test.js test.js:2: ReferenceError: obj is not defined
Assignee | ||
Updated•12 years ago
|
Assignee: general → dvander
Status: NEW → ASSIGNED
Assignee | ||
Comment 1•12 years ago
|
||
Two bugs, one is that we emitted an inlined setprop even if the object was watched. Second, DefVar wasn't using the right attrs.
Attachment #627388 -
Flags: review?
Assignee | ||
Updated•12 years ago
|
Attachment #627388 -
Flags: review? → review?(sstangl)
Reporter | ||
Comment 3•12 years ago
|
||
This bug shows up in quite a few different forms during differential testing, so it'd be good to land this before starting any further testing of this type.
Whiteboard: [fuzzblocker]
Updated•12 years ago
|
Attachment #627388 -
Flags: review?(sstangl) → review+
Assignee | ||
Comment 4•12 years ago
|
||
http://hg.mozilla.org/projects/ionmonkey/rev/d0e27348e778
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•