Hi again.
I'm trying to solve bug 434031, where in optimised compilation mode
certain assignments to object properties result in a property named
"NaN" being created. This seems to occur when the assignment is done in
a direct call function, where the object index is one of the function's
parameters.
Here's the test case from the bug, whittled down a little further:
function add(_object, _key, _value) {
_object[_key] = _value;
}
function f() {
add({}, 'c', 'd');
}
var o = { };
add(o, 'a', 'b');
java.lang.System.out.println(o.toSource())
This prints '({NaN:"b"})', but should print '{a:"b"}'. If we replace
add() with:
function add(_object, _key, _value) {
var key = _key;
_object[key] = _value;
}
then we get the desired output.
When the object indexing is done via the local variable, this exercises
the second if-statement clause of the Token.GETVAR case in
Optimizer.rewriteForNumberVariables(Node,int):
http://mxr.mozilla.org/js/source/js/rhino/src/org/mozilla/javascript/optimizer/Optimizer.java#173
That works, since isNumberVar() returns whether the flow analysis
determined that the variable would always be a number. In the first
clause of the if-statement, though, the one for when a function
parameter is used as the object index, there isn't any similar check.
So, a few questions:
* What are the exact conditions under which a function will be
determined to be a direct call function, and what assumptions
are then made?
* Why are isNumberVar() and setIsNumberVar() on OptFunctionNode
restricted for use with non-parameter locals?
* Why aren't the values in the varTypes array in
Block.runFlowAnalyzes() that correspond to parameters used?
* Does the flow analyser in Block actually assign any value other than
AnyType to function parameters?
Thanks,
Cameron
--
Cameron McCormack ≝ http://mcc.id.au/
_______________________________________________
dev-tech-js-engine-rhino mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-tech-js-engine-rhino
