Bug 117349 – ARM/JIT: associative array access by a var may return an undefined object

• Component: JavaScriptCore
• Status: RESOLVED DUPLICATE

[Stephane Cerveau]

A tab of object returns sometimes an undefined object when this tab is accessed by a var containing the identifying string. This bug occurs only when the assignation is done in function in the first line. This bug only occurs on ARM-V7 platform with JIT enabled.

Ex:

function setShader(name){
   currentProgram = shaderProgram[name];
}

In this case name is always the same string 'string'.

CurrentProgram will be sometimes undefined.

It does not fail when currentProgram= shaderProgram['string'] 

It does not fail if an instruction is done before like

var iterator;
function setShader(name){
   iterator++;
   currentProgram = shaderProgram[name];
}

[Stephane Cerveau]

Created attachment 204045 [details]
Test case. Jellyfish webgl

Here is a test case.
This test case allows to reproduce the bug on ARM-V7 platform. On my platform the bug occurs after 68 iterations average.
An alert should pop up when the object in initShader.js/SetShader is undefined.
Unfortunatly i havent been able to clean up the code to reproduce the same kind of issue.

[Stephane Cerveau]

The problem occurs only in release mode.

[Stephane Cerveau]

*** This bug has been marked as a duplicate of bug 116306 ***