Last Comment Bug 758991 - IonMonkey: Differential Testing: Missing ReferenceError with caller and ion
: IonMonkey: Differential Testing: Missing ReferenceError with caller and ion
Status: RESOLVED FIXED
: regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Linux
: -- critical (vote)
: ---
Assigned To: Jan de Mooij [:jandem] (PTO until July 31)
:
Mentors:
Depends on:
Blocks: langfuzz IonFuzz
  Show dependency treegraph
 
Reported: 2012-05-27 14:46 PDT by Christian Holler (:decoder)
Modified: 2012-05-30 03:08 PDT (History)
7 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Patch (1.51 KB, patch)
2012-05-29 08:45 PDT, Jan de Mooij [:jandem] (PTO until July 31)
dvander: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2012-05-27 14:46:16 PDT
The following testcase shows different behavior with options --ion -n -m --ion-eager vs. --no-ion on ionmonkey revision 4ce3983a43f4:


function TestCase(n, d, e, a)
  this.passed = getTestCaseResult(e, a);
function reportCompare (expected, actual, description) {
  var testcase = new TestCase("unknown-test-name", description, expected, actual);
    if (testcase.passed)
      print(PASSED + description);
}
function getTestCaseResult(expected, actual) {
    return actual == expected;
}
var UBound = 0;
var statusitems = [];
var actualvalues = [];
var expectedvalues = [];
var o = {p:'object'};
function f(obj) {
  return f.caller.p ;
}
function g(obj) {
  return f(obj);
}
g.p = "hello";
function gg(obj) {
  return f.call(obj, obj);
}
actual = g(o);
actual = gg(((function  (  )  {  }  )       ));
  actualvalues[UBound] = actual;
  UBound++;
  for (var i=0; i<UBound; i++)
    reportCompare(expectedvalues[i], actualvalues[i], statusitems[i]);



$ debug64/js --ion -n -m --ion-eager test.js
<no output or error>


$ debug64/js --no-ion test.js
test.js:6: ReferenceError: PASSED is not defined


This doesn't seem to be fixed by the patch in bug 758543 so I assume it's a different bug.
Comment 1 Jan de Mooij [:jandem] (PTO until July 31) 2012-05-29 08:45:13 PDT
Created attachment 627974 [details] [diff] [review]
Patch

Don't optimize a singleton property access if the property has a non-default getter (fun.caller in this case). This also matches JM.
Comment 2 Jan de Mooij [:jandem] (PTO until July 31) 2012-05-30 03:08:36 PDT
https://hg.mozilla.org/projects/ionmonkey/rev/e290eb3d9506

Note You need to log in before you can comment on or make changes to this bug.