Closed Bug 758543 Opened 12 years ago Closed 12 years ago

IonMonkey: Differential Testing: Missing ReferenceError with __proto__ and ion

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Assigned: dvander)

References

Details

(Keywords: regression, testcase, Whiteboard: [fuzzblocker])

Attachments

(1 file)

The following testcase shows different behavior with options --ion -n -m --ion-eager vs. --no-ion on ionmonkey revision c05b873dad48:


y = this.watch("x", function() {
  var result = x * obj;
});
var save__proto__ = __proto__;
__proto__ = save__proto__;
evaluate("{ function x() {} }");
evaluate("var x = {};");


$ debug64/js --ion -n -m --ion-eager test.js
<no output or error>


$ debug64/js --no-ion test.js
test.js:2: ReferenceError: obj is not defined
Assignee: general → dvander
Status: NEW → ASSIGNED
Attached patch fixSplinter Review
Two bugs, one is that we emitted an inlined setprop even if the object was watched. Second, DefVar wasn't using the right attrs.
Attachment #627388 - Flags: review?
Attachment #627388 - Flags: review? → review?(sstangl)
This bug shows up in quite a few different forms during differential testing, so it'd be good to land this before starting any further testing of this type.
Whiteboard: [fuzzblocker]
Attachment #627388 - Flags: review?(sstangl) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/d0e27348e778
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.