When a property is found in a prototype of the object, the linkage we emit is incorrect, as we emit a method bound to the prototype instance, but guarding on the map and switchpointing on an event listener for the map. Here's a little reproducer that will print "Expecting 2: 1" in the second line instead of "Expecting 2: 2" as ��� well ��� expected. The reason for this is that the second invocation of function "inner" will keep its linkage for "dyn:getProp:x" bound to the prototype - in this case, the scope obect of f(x) invocation from the first invocation with f(1), and neither the map guard nor the prototype guard will be invalidated. function f(x) { return (function inner() { var y; (function dummy() { return y })() // force own scope for the inner function with({}) { // 'with' block turns off fast scopes // Getter for 'x' will now use prototype-bound linking. // Unfortunately, it'll get bound to the scope of the first invocation of f(x). return x } })(); } print("Expecting 1: " + f(1)) print("Expecting 2: " + f(2))
|