458098 - js_DumpObject can't handle objects that share proto's scope

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jason Orendorff [:jorendorff]]

Attachment: fix

Objects with no 'own properties' share their proto's scope; calling js_DumpObject on such an object can crash because the object doesn't have the slots that the scope describes.

With the patch, it'll print "no own properties - see proto".

(trivial) The patch also adds a newline that was missing before.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 341314 [details] [diff] [review]
fix

>diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
>+        sharesScope = (proto && scope == OBJ_SCOPE(proto));

Drive-by question: this could also be written as 'sharesScope = scope->obj == obj;' right?

Comment 2

[Brendan Eich [:brendan]]

(In reply to comment #1)
> (From update of attachment 341314 [details] [diff] [review])
> >diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
> >+        sharesScope = (proto && scope == OBJ_SCOPE(proto));
> 
> Drive-by question: this could also be written as 'sharesScope = scope->obj ==
> obj;' right?

That's the faster way (and clearer, maybe) way to test.

/be

Comment 3

[Jason Orendorff [:jorendorff]]

I changed that line to say
  sharesScope = (scope->obj != obj);

http://hg.mozilla.org/mozilla-central/rev/765855ec09b0