Updates:
Status: Fixed
Comment #3 on issue 979 by [email protected]: Failure in mozilla test
js1_3/inherit/proto_11.js
http://code.google.com/p/v8/issues/detail?id=979
The issue here was that we did not faithfully simulate the unoptimized
expression stack in the case of postfix increment or decrement of a
variable.
We recently refactored bailout points a bit to put them exactly where a
side effect occurs, which exposed the incorrect simulation checkpoint that
was previously hidden by a later one.
Fixed in revision 6025. I'll put together a regression test when I get a
chance.
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
