Closed
Bug 592412
Opened 14 years ago
Closed 14 years ago
TM: wrong behavior setting existing properties to joined function object values
Categories
(Core :: JavaScript Engine, defect, P1)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla2.0
Tracking | Status | |
---|---|---|
blocking2.0 | --- | betaN+ |
People
(Reporter: bhackett1024, Assigned: brendan)
References
Details
(Whiteboard: fixed-in-tracemonkey)
Attachments
(1 file)
(deleted),
patch
|
jorendorff
:
review+
|
Details | Diff | Splinter Review |
For this testcase: function f() { var a = [{m: 0}, {m: 1}]; var b = [{}, {}]; for (var i = 0; i < 2; i++) { a[i].m = function() { return 0; }; b[i].m = function() { return 1; }; } print(a[0].m == a[1].m); print(b[0].m == b[1].m); } f(); I get this output from TM/JM: true false I think that both equalities should be false.
Reporter | ||
Updated•14 years ago
|
Assignee: general → brendan
Assignee | ||
Updated•14 years ago
|
blocking2.0: --- → ?
Priority: -- → P1
Target Milestone: --- → mozilla2.0
Assignee | ||
Updated•14 years ago
|
Status: NEW → ASSIGNED
Assignee | ||
Comment 1•14 years ago
|
||
Trying to keep joining function objects is tough. If the pre-existing property is a writable data property, then we could try reshaping it to have the METHOD flag. That means forking the shape tree or going to dictionary mode. This patch instead keeps things relatively simple by giving up and unjoining (cloning) unless the pre-existing shape is already a method. /be
Attachment #470971 -
Flags: review?(jorendorff)
Assignee | ||
Updated•14 years ago
|
Summary: TM: wrong behavior setting existing properties with function objects → TM: wrong behavior setting existing properties to function object values
Assignee | ||
Updated•14 years ago
|
Summary: TM: wrong behavior setting existing properties to function object values → TM: wrong behavior setting existing properties to joined function object values
Comment 2•14 years ago
|
||
Comment on attachment 470971 [details] [diff] [review] proposed fix As much as it hurts to make this function any more complicated than it already is, this seems just right.
Attachment #470971 -
Flags: review?(jorendorff) → review+
Assignee | ||
Comment 3•14 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/a94f533cf703 /be
Whiteboard: fixed-in-tracemonkey
Updated•14 years ago
|
blocking2.0: ? → betaN+
Assignee | ||
Comment 4•14 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/a94f533cf703 /be
Status: ASSIGNED → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•