IonMonkey: Differential Testing: Missing ReferenceError with caller and ion

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Assigned: jandem)

Tracking

(Blocks: 2 bugs, {regression, testcase})

Other Branch
x86_64
Linux
regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
The following testcase shows different behavior with options --ion -n -m --ion-eager vs. --no-ion on ionmonkey revision 4ce3983a43f4:


function TestCase(n, d, e, a)
  this.passed = getTestCaseResult(e, a);
function reportCompare (expected, actual, description) {
  var testcase = new TestCase("unknown-test-name", description, expected, actual);
    if (testcase.passed)
      print(PASSED + description);
}
function getTestCaseResult(expected, actual) {
    return actual == expected;
}
var UBound = 0;
var statusitems = [];
var actualvalues = [];
var expectedvalues = [];
var o = {p:'object'};
function f(obj) {
  return f.caller.p ;
}
function g(obj) {
  return f(obj);
}
g.p = "hello";
function gg(obj) {
  return f.call(obj, obj);
}
actual = g(o);
actual = gg(((function  (  )  {  }  )       ));
  actualvalues[UBound] = actual;
  UBound++;
  for (var i=0; i<UBound; i++)
    reportCompare(expectedvalues[i], actualvalues[i], statusitems[i]);



$ debug64/js --ion -n -m --ion-eager test.js
<no output or error>


$ debug64/js --no-ion test.js
test.js:6: ReferenceError: PASSED is not defined


This doesn't seem to be fixed by the patch in bug 758543 so I assume it's a different bug.
(Assignee)

Updated

5 years ago
Assignee: general → jdemooij
Status: NEW → ASSIGNED
(Assignee)

Comment 1

5 years ago
Created attachment 627974 [details] [diff] [review]
Patch

Don't optimize a singleton property access if the property has a non-default getter (fun.caller in this case). This also matches JM.
Attachment #627974 - Flags: review?(dvander)
Attachment #627974 - Flags: review?(dvander) → review+
(Assignee)

Comment 2

5 years ago
https://hg.mozilla.org/projects/ionmonkey/rev/e290eb3d9506
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.