Closed Bug 452189 Opened 16 years ago Closed 16 years ago

regression (from firefox 2): prototype setters not called by inline cache for [[put]]

Categories

(Core :: JavaScript Engine, defect, P2)

Product:
Core
Component:
JavaScript Engine
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla1.9.1

People

(Reporter: geoffreygaren, Assigned: brendan)

References

Details

(Keywords: regression, testcase, Whiteboard: fixed-in-tracemonkey)

Attachments

(3 files, 1 obsolete file)

test case
(deleted), text/html
Details
testcase for the shell
(deleted), text/plain
Details
fix
(deleted), patch
mrbkap
: review+
Details | Diff | Splinter Review
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_4; en-us) AppleWebKit/525.18 (KHTML, like Gecko) Version/3.1.1 Safari/525.20 Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.1) Gecko/2008070206 Firefox/3.0.1 If a setter is added to the prototype chain after a body of code has specialized for [[put]], the specialized body of code will fail to call the setter. This is a regression from Firefox 2. See attached test case (coming soon!). Reproducible: Always Steps to Reproduce: Load attached test case. Actual Results: "FAIL" Expected Results: "PASS"
Attached file test case (deleted) —
This testcase regressed between 2008020700 (works) and 2008020800 (fails).
Smaller range: http://bonsai.mozilla.org/cvsquery.cgi?module=PhoenixTinderbox&date=explicit&mindate=2008-02-07+14%3A00&maxdate=2008-02-07+16%3A00
Assignee: nobody → general
Blocks: js-propcache
Status: UNCONFIRMED → NEW
Component: General → JavaScript Engine
Ever confirmed: true
Keywords: regression, testcase
OS: Mac OS X → All
Product: Firefox → Core
QA Contact: general → general
Hardware: PC → All
Version: unspecified → Trunk
Flags: blocking1.9.1?
Attached patch Proposed fix (obsolete) (deleted) — — Splinter Review
Assignee: general → mrbkap
Status: NEW → ASSIGNED
Attachment #335591 - Flags: review?(brendan)
Attached file testcase for the shell (deleted) —
This is a simplified testcase for the shell.
Fixed on tm: http://hg.mozilla.org/tracemonkey/index.cgi/rev/4714cee8d904 and on m-c: http://hg.mozilla.org/mozilla-central/index.cgi/rev/a2ae40e570a7 /be
Status: ASSIGNED → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
Let's get this into the branch as a regression fix, if it bakes well on trunk for a bit.
Flags: blocking1.9.0.3?
Sorry! Comment 6 is in the wrong bug. /be
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Assignee: mrbkap → brendan
Status: REOPENED → NEW
Status: NEW → ASSIGNED
Priority: -- → P1
Target Milestone: --- → mozilla1.9.1
Attachment #335591 - Flags: review?(brendan)
Priority: P1 → P2
Flags: blocking1.9.1? → blocking1.9.1+
This bug is not fixed on trunk despite an old patch, and apparently missed "baking" in the beta. Is it realistic to block a branch release for it?
Flags: wanted1.9.0.x+
Flags: in-testsuite?
Flags: blocking1.9.0.4?
(In reply to comment #9) > This bug is not fixed on trunk despite an old patch, and apparently missed > "baking" in the beta. Is it realistic to block a branch release for it? Certainly not. Should have a patch for the next next release. /be
Attachment #335591 - Flags: review?(brendan)
Comment on attachment 335591 [details] [diff] [review] Proposed fix I hope to fix this differently. /be
Attachment #335591 - Flags: review?(brendan) → review-
Flags: blocking1.9.1+ → wanted1.9.1+
Attached patch fix (deleted) — — Splinter Review
Attachment #335591 - Attachment is obsolete: true
Attachment #376377 - Flags: review?(mrbkap)
Attachment #376377 - Flags: review?(mrbkap) → review+
Fixed in tm: http://hg.mozilla.org/tracemonkey/rev/cffb2a5d4489 /be
Whiteboard: fixed-in-tracemonkey
Fixed in m-c: http://hg.mozilla.org/mozilla-central/rev/8c9a6d851018 /be
Status: ASSIGNED → RESOLVED
Closed: 16 years ago → 16 years ago
Resolution: --- → FIXED
This checkin is in a range suspected to have caused a TXul regression on OSX: Regression: Txul increase from 312.789 to 326.947 (4.53%) on Sun May 10 16:20:00 2009. Mac105 1.9.2 build 20090510132032 http://graphs.mozilla.org/#show=794371,794398,794384&sel=1241813896,1242159496 http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=6ea54bfd7c28&tochange=a6068cf686fe
Depends on: 492355
Filed bug 492355 to track that regression.
(In reply to comment #12) > Created an attachment (id=376377) [details] > fix Hm, this purges just the property cache for the current thread. It does not take care about the cache embedded into the jited code or on other threads.
(In reply to comment #17) > (In reply to comment #12) > > Created an attachment (id=376377) [details] [details] > > fix > > Hm, this purges just the property cache for the current thread. It does not > take care about the cache embedded into the jited code or on other threads. See bug 492355. /be
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: