Comment #4 on issue 979 by [email protected]: Failure in mozilla test js1_3/inherit/proto_11.js
http://code.google.com/p/v8/issues/detail?id=979
The issue here was that we did not faithfully simulate the unoptimized expression stack in the case of postfix increment or decrement of a variable.
We recently refactored bailout points a bit to put them exactly where a side effect occurs, which exposed the incorrect simulation checkpoint that was previously hidden by a later one.
Fixed in revision 6025. I'll put together a regression test when I get a chance.
-- v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev
