240577 - obj.watch code predates cloned function objects, uses fun->object wrongly

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Brendan Eich [:brendan]]

leading to the complaint at the news: URL by Jens Thiele.  Patch next.

/be

Comment 1

[Brendan Eich [:brendan]]

Testcase:

var f=function(text){ return (function(id,o,n){print(text);return n;}); }
var w=f("Hello");
w();
foo={x:1}
foo.watch("x",w);
foo.x=10;

/be

Comment 2

[Brendan Eich [:brendan]]

Attachment: proposed fix

This is good for the 1.7 branch as well as the trunk.

/be

Comment 3

[Brendan Eich [:brendan]]

Attachment: further fixing for other ValueToFunction|fun->object abuses

Comment 4

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 146167 [details] [diff] [review]
proposed fix

r=shaver.

Comment 5

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 146199 [details] [diff] [review]
further fixing for other ValueToFunction|fun->object abuses

r=shaver

Comment 6

[Brendan Eich [:brendan]]

Fixed on the trunk.  Going for 1.7 approval.

/be

Comment 7

[Brendan Eich [:brendan]]

Comment on attachment 146167 [details] [diff] [review]
proposed fix

Safe fix, get the right one of N objects instead of converting it via an N:1
mapping, then backing up via the "primary" parent link.

/be

Comment 8

[Brendan Eich [:brendan]]

Fixed on brnach.

/be

Comment 9

[Bob Clary [:bc] (inactive)]

Attachment: js1_5/Regress/regress-240577.js

I'll write to Jens.

Comment 10

[Bob Clary [:bc] (inactive)]

Attachment: js1_5/Regress/regress-240577.js

Comment 11

[Bob Clary [:bc] (inactive)]

Attachment: js1_5/Regress/regress-240577.js

could not get a response from Jens, rewrote
js/tests/js1_5/Regress/regress-240577.js to not require permission. checked in.

Comment 12

[Bob Clary [:bc] (inactive)]

verified fixed.