Closed
Bug 511241
Opened 15 years ago
Closed 15 years ago
TM: JSOP_NAME wrong value with heavyweight function, eval
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
DUPLICATE
of bug 505591
People
(Reporter: dmandelin, Unassigned)
Details
From bug 510642 comment 8:
var d = 1;
function heavy(x) {
eval(x);
return function lite() {
var s = 0;
for (var i = 0; i < 9; i++)
s += d;
return s;
};
}
var f1 = heavy("1");
var f2 = heavy("var d = 100;");
assertEq(f1(), 9);
assertEq(f2(), 900);
We get f2() == 9. The second call apparently doesn't notice the new 'd'. This might be missing shape guard in a call special case, but I don't really know yet.
Reporter | ||
Comment 1•15 years ago
|
||
The problem: when we record the trace, we find 'd' on the global object. The case for this in scopeChainProp then simply imports from the global object, without any guards. The second time we run the trace, we get from the global again, which is wrong.
This is fixed if I add the "check shapes for all heavyweight objects up the chain" check to that case in scopeChainProp. It appears that the global shape does not change here; is that right?
Comment 2•15 years ago
|
||
Why doesn't PurgeProtoChain reshape the global?
/be
Reporter | ||
Comment 3•15 years ago
|
||
(In reply to comment #2)
> Why doesn't PurgeProtoChain reshape the global?
I had to think about that for a while. It does reshape the global, but that doesn't save us. In this test, the global reshaping happens before any trace is run, so times we see the loop, we have the same global shape. But checking the heavyweights should work.
Comment 4•15 years ago
|
||
Brendan, it's a foreshadowing case.
Reporter | ||
Comment 5•15 years ago
|
||
Test case pushed to TM as 7a48e1cea3bd.
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•