Ted found this when he was testing behavior between us and V8. Consider the following: class C { get prop_this() { return this; } } class D extends C { super_get() { return super.prop_this } } new D().super_get.call(3); // Supposed to be unboxed 3 Class definitions are always strict, which means |this| values aren't supposed to be boxed. However, we currently always box '3', because we don't correctly implement super properties. Namely, Super References [1] are like References but have an additional |this| value. We instead go through the usual GetProperty path in JSOP_GETPROP_SUPER, and always end up boxing the receiver. [1] https://tc39.github.io/ecma262/#super-reference

I found it. We use FETCH_OBJECT in interpreter when we shouldn't. https://dxr.mozilla.org/mozilla-central/rev/72346a4d6afcc17504f911190dbf470100e879ec/js/src/vm/Interpreter.cpp#2790 Quick fix makes the test pass. GETELEM_SUPER needs more plumbing to use Value instead of Object.

(In reply to Ted Campbell [:tcampbell] from comment #1) > I found it. We use FETCH_OBJECT in interpreter when we shouldn't. > > https://dxr.mozilla.org/mozilla-central/rev/ > 72346a4d6afcc17504f911190dbf470100e879ec/js/src/vm/Interpreter.cpp#2790 > > Quick fix makes the test pass. GETELEM_SUPER needs more plumbing to use > Value instead of Object. Oops, sorry, I didn't see that you had already assigned it to yourself.

Thanks for doing the patch. I hadn't started it yet.

This also fixes the following bug, but it is unclear why. There seems to be an underlying issue to investigate. > class C { > get foo() { return "Hello"; } > } > C.prototype[0] = "zero"; > C.prototype["undefined"] = "ಠ_ಠ"; > > class D extends C { > sup(pname) { return super[pname]; } > } > > let d = new D(); > assertEq(d.sup(0), "zero"); > assertEq(d.sup("foo"), "Hello");

https://searchfox.org/mozilla-central/rev/b425854d9bbd49d5caf9baef3686e49ec91c17ec/js/src/vm/Interpreter.cpp#2914 https://searchfox.org/mozilla-central/rev/b425854d9bbd49d5caf9baef3686e49ec91c17ec/js/src/vm/Interpreter-inl.h#517 The input key and output value alias in the existing code. Then the GetPropertyNoGC call writes output to undefined and after they key is re-read and results in property "undefined" being looked up.

That aliasing bug. Ew.

Pushed by shu@rfrn.org: https://hg.mozilla.org/integration/mozilla-inbound/rev/5cac74206e4e Fix super getprop and super getelem to not box 'this' values. (r=jorendorff)