758543 - IonMonkey: Differential Testing: Missing ReferenceError with __proto__ and ion

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase shows different behavior with options --ion -n -m --ion-eager vs. --no-ion on ionmonkey revision c05b873dad48:


y = this.watch("x", function() {
  var result = x * obj;
});
var save__proto__ = __proto__;
__proto__ = save__proto__;
evaluate("{ function x() {} }");
evaluate("var x = {};");


$ debug64/js --ion -n -m --ion-eager test.js
<no output or error>


$ debug64/js --no-ion test.js
test.js:2: ReferenceError: obj is not defined

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Two bugs, one is that we emitted an inlined setprop even if the object was watched. Second, DefVar wasn't using the right attrs.

Comment 3

[Christian Holler (:decoder)]

This bug shows up in quite a few different forms during differential testing, so it'd be good to land this before starting any further testing of this type.

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/projects/ionmonkey/rev/d0e27348e778