758991 - IonMonkey: Differential Testing: Missing ReferenceError with caller and ion

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase shows different behavior with options --ion -n -m --ion-eager vs. --no-ion on ionmonkey revision 4ce3983a43f4:


function TestCase(n, d, e, a)
  this.passed = getTestCaseResult(e, a);
function reportCompare (expected, actual, description) {
  var testcase = new TestCase("unknown-test-name", description, expected, actual);
    if (testcase.passed)
      print(PASSED + description);
}
function getTestCaseResult(expected, actual) {
    return actual == expected;
}
var UBound = 0;
var statusitems = [];
var actualvalues = [];
var expectedvalues = [];
var o = {p:'object'};
function f(obj) {
  return f.caller.p ;
}
function g(obj) {
  return f(obj);
}
g.p = "hello";
function gg(obj) {
  return f.call(obj, obj);
}
actual = g(o);
actual = gg(((function  (  )  {  }  )       ));
  actualvalues[UBound] = actual;
  UBound++;
  for (var i=0; i<UBound; i++)
    reportCompare(expectedvalues[i], actualvalues[i], statusitems[i]);



$ debug64/js --ion -n -m --ion-eager test.js
<no output or error>


$ debug64/js --no-ion test.js
test.js:6: ReferenceError: PASSED is not defined


This doesn't seem to be fixed by the patch in bug 758543 so I assume it's a different bug.

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Patch

Don't optimize a singleton property access if the property has a non-default getter (fun.caller in this case). This also matches JM.

Comment 2

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/projects/ionmonkey/rev/e290eb3d9506