{"action":"created","issue":{"url":"https://api.github.com/repos/Microsoft/ChakraCore/issues/5254","repository_url":"https://api.github.com/repos/Microsoft/ChakraCore","labels_url":"https://api.github.com/repos/Microsoft/ChakraCore/issues/5254/labels{/name}","comments_url":"https://api.github.com/repos/Microsoft/ChakraCore/issues/5254/comments","events_url":"https://api.github.com/repos/Microsoft/ChakraCore/issues/5254/events","html_url":"https://github.com/Microsoft/ChakraCore/pull/5254","id":328220641,"node_id":"MDExOlB1bGxSZXF1ZXN0MTkxODE2MTc1","number":5254,"title":"OS#16649604: JsFunFuzz:CAS:x64::DEBUG JIT is causing a bad code gen","user":{"login":"paolosevMSFT","id":16579539,"node_id":"MDQ6VXNlcjE2NTc5NTM5","avatar_url":"https://avatars2.githubusercontent.com/u/16579539?v=4","gravatar_id":"","url":"https://api.github.com/users/paolosevMSFT","html_url":"https://github.com/paolosevMSFT","followers_url":"https://api.github.com/users/paolosevMSFT/followers","following_url":"https://api.github.com/users/paolosevMSFT/following{/other_user}","gists_url":"https://api.github.com/users/paolosevMSFT/gists{/gist_id}","starred_url":"https://api.github.com/users/paolosevMSFT/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/paolosevMSFT/subscriptions","organizations_url":"https://api.github.com/users/paolosevMSFT/orgs","repos_url":"https://api.github.com/users/paolosevMSFT/repos","events_url":"https://api.github.com/users/paolosevMSFT/events{/privacy}","received_events_url":"https://api.github.com/users/paolosevMSFT/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-05-31T17:00:15Z","updated_at":"2018-06-02T00:35:22Z","closed_at":null,"author_association":"MEMBER","pull_request":{"url":"https://api.github.com/repos/Microsoft/ChakraCore/pulls/5254","html_url":"https://github.com/Microsoft/ChakraCore/pull/5254","diff_url":"https://github.com/Microsoft/ChakraCore/pull/5254.diff","patch_url":"https://github.com/Microsoft/ChakraCore/pull/5254.patch"},"body":"GlobOpt::ToTypeSpecIndex() generate the wrong code for a getter (or setter) like:\r\n```\r\nconst n = 1;\r\nfunction test2() {\r\n  d = {\r\n    get [n]() { return 42; },\r\n  };\r\n}\r\n```\r\nwhere y can be type specialized to an integer:\r\n\r\n```\r\ns18(s6).i32 =  FromVar s6[LikelyCanBeTaggedValue_Int].var!\r\n[s5[UninitializedObject].var+s18(s6).i32!].var = InitGetElemI  s7.var!\r\n```\r\n\r\nwhile, for non-integer computed properties:\r\n\r\n```\r\n[s5[UninitializedObject].var+s6[LikelyCanBeTaggedValue_String].var!].var = InitGetElemI  s7.var!\r\n```\r\n\r\nwhere s5: object, s6: computed property, s7: getter function.\r\n\r\nThen, in Lowerer::LowerStElemI(), if the helper method is a getter or a setter, the generated code calls Op_SetElementI_Int32() and as result:\r\n\r\n```\r\nvar v = d[1];\r\n```\r\ntypeof(v) is 'function' and not 'number'.\r\n\r\nTo fix this there are two possibilities:\r\n1. In GlobOpt::ToTypeSpecIndex() we can skip type spec for the index operand if the instruction is a getter or setter.\r\n2. In Lowerer::LowerStElemI() we should replace the integer index with its equivalent var symbol. \r\n\r\nThis PR implements both fixes (even though the first one would be sufficient)."},"comment":{"url":"https://api.github.com/repos/Microsoft/ChakraCore/issues/comments/394042506","html_url":"https://github.com/Microsoft/ChakraCore/pull/5254#issuecomment-394042506","issue_url":"https://api.github.com/repos/Microsoft/ChakraCore/issues/5254","id":394042506,"node_id":"MDEyOklzc3VlQ29tbWVudDM5NDA0MjUwNg==","user":{"login":"pleath","id":15825988,"node_id":"MDQ6VXNlcjE1ODI1OTg4","avatar_url":"https://avatars0.githubusercontent.com/u/15825988?v=4","gravatar_id":"","url":"https://api.github.com/users/pleath","html_url":"https://github.com/pleath","followers_url":"https://api.github.com/users/pleath/followers","following_url":"https://api.github.com/users/pleath/following{/other_user}","gists_url":"https://api.github.com/users/pleath/gists{/gist_id}","starred_url":"https://api.github.com/users/pleath/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pleath/subscriptions","organizations_url":"https://api.github.com/users/pleath/orgs","repos_url":"https://api.github.com/users/pleath/repos","events_url":"https://api.github.com/users/pleath/events{/privacy}","received_events_url":"https://api.github.com/users/pleath/received_events","type":"User","site_admin":false},"created_at":"2018-06-02T00:35:22Z","updated_at":"2018-06-02T00:35:22Z","author_association":"MEMBER","body":"I see. I wonder if the benefit of the existing type-specialized-index helpers is that jitted code doesn't need to keep both the specialize and non-specialized values live at the same time."}}
{"actor":{"display_login":"pleath"}}