Last Comment Bug 758991 - IonMonkey: Differential Testing: Missing ReferenceError with caller and ion
: IonMonkey: Differential Testing: Missing ReferenceError with caller and ion
: regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Linux
-- critical (vote)
: ---
Assigned To: Jan de Mooij [:jandem]
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: langfuzz IonFuzz
  Show dependency treegraph
Reported: 2012-05-27 14:46 PDT by Christian Holler (:decoder)
Modified: 2012-05-30 03:08 PDT (History)
7 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Patch (1.51 KB, patch)
2012-05-29 08:45 PDT, Jan de Mooij [:jandem]
dvander: review+
Details | Diff | Splinter Review

Description User image Christian Holler (:decoder) 2012-05-27 14:46:16 PDT
The following testcase shows different behavior with options --ion -n -m --ion-eager vs. --no-ion on ionmonkey revision 4ce3983a43f4:

function TestCase(n, d, e, a)
  this.passed = getTestCaseResult(e, a);
function reportCompare (expected, actual, description) {
  var testcase = new TestCase("unknown-test-name", description, expected, actual);
    if (testcase.passed)
      print(PASSED + description);
function getTestCaseResult(expected, actual) {
    return actual == expected;
var UBound = 0;
var statusitems = [];
var actualvalues = [];
var expectedvalues = [];
var o = {p:'object'};
function f(obj) {
  return f.caller.p ;
function g(obj) {
  return f(obj);
g.p = "hello";
function gg(obj) {
  return, obj);
actual = g(o);
actual = gg(((function  (  )  {  }  )       ));
  actualvalues[UBound] = actual;
  for (var i=0; i<UBound; i++)
    reportCompare(expectedvalues[i], actualvalues[i], statusitems[i]);

$ debug64/js --ion -n -m --ion-eager test.js
<no output or error>

$ debug64/js --no-ion test.js
test.js:6: ReferenceError: PASSED is not defined

This doesn't seem to be fixed by the patch in bug 758543 so I assume it's a different bug.
Comment 1 User image Jan de Mooij [:jandem] 2012-05-29 08:45:13 PDT
Created attachment 627974 [details] [diff] [review]

Don't optimize a singleton property access if the property has a non-default getter (fun.caller in this case). This also matches JM.
Comment 2 User image Jan de Mooij [:jandem] 2012-05-30 03:08:36 PDT

Note You need to log in before you can comment on or make changes to this bug.