Closed Bug 758991 Opened 12 years ago Closed 12 years ago

IonMonkey: Differential Testing: Missing ReferenceError with caller and ion

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Assigned: jandem)

References

Details

(Keywords: regression, testcase)

Attachments

(1 file)

The following testcase shows different behavior with options --ion -n -m --ion-eager vs. --no-ion on ionmonkey revision 4ce3983a43f4: function TestCase(n, d, e, a) this.passed = getTestCaseResult(e, a); function reportCompare (expected, actual, description) { var testcase = new TestCase("unknown-test-name", description, expected, actual); if (testcase.passed) print(PASSED + description); } function getTestCaseResult(expected, actual) { return actual == expected; } var UBound = 0; var statusitems = []; var actualvalues = []; var expectedvalues = []; var o = {p:'object'}; function f(obj) { return f.caller.p ; } function g(obj) { return f(obj); } g.p = "hello"; function gg(obj) { return f.call(obj, obj); } actual = g(o); actual = gg(((function ( ) { } ) )); actualvalues[UBound] = actual; UBound++; for (var i=0; i<UBound; i++) reportCompare(expectedvalues[i], actualvalues[i], statusitems[i]); $ debug64/js --ion -n -m --ion-eager test.js <no output or error> $ debug64/js --no-ion test.js test.js:6: ReferenceError: PASSED is not defined This doesn't seem to be fixed by the patch in bug 758543 so I assume it's a different bug.
Assignee: general → jdemooij
Status: NEW → ASSIGNED
Attached patch PatchSplinter Review
Don't optimize a singleton property access if the property has a non-default getter (fun.caller in this case). This also matches JM.
Attachment #627974 - Flags: review?(dvander)
Attachment #627974 - Flags: review?(dvander) → review+
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: