Status: New
Owner: ----
New issue 4053 by [email protected]: setters-on-elements test bug.
https://code.google.com/p/v8/issues/detail?id=4053
The setters-on-elements test of mjsunit has a potential bug.
In part of setters-on-elements.js file..
-------------------------------------------------
// Testcase: setter "deep" in prototype chain.
clearFunctionTypeFeedback(foo);
deoptimizeFunction(foo);
clearFunctionTypeFeedback(foo);
calls = 0;
a = create_func();
var ap2 = [];
a.__proto__ = ap2;
foo(a);
foo(a);
foo(a); // --> if the foo function is entered to the OPTIMIZED code at
this time,
delete a[index];
assertEquals(0, calls);
ap2.__proto__ = ap; // "sneak" in a callback.
// The sneak case should be caught by unoptimized code too.
assertUnoptimized(foo); // --> ASSERT occurs here.
foo(a);
foo(a);
foo(a);
assertEquals(3, calls);
-------------------------------------------------
Please refer to the above comment in the code.
To resolve this situation,
"foo(a);" statement should be inserted before the "assertUnoptimized(foo);".
Isn't it?
ap2.__proto__ = ap; // "sneak" in a callback.
// The sneak case should be caught by unoptimized code too.
assertUnoptimized(foo);
foo(a);
foo(a);
foo(a);
assertEquals(3, calls);
---------->
ap2.__proto__ = ap; // "sneak" in a callback.
// The sneak case should be caught by unoptimized code too.
foo(a); // <-------
assertUnoptimized(foo);
foo(a);
foo(a);
foo(a);
assertEquals(4, calls); // <------- (3 -> 4)
--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
