604896 - Crash [@ js_ValueToString] when trying to get the the parent of a function, scoped in a function, scoped in an object

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Comment 1

[Asaf Romano (gone)]

Attachment: testcase

This, of course, requires UniversalXPConnect.

Comment 2

[Asaf Romano (gone)]

Attachment: log

Comment 3

[Asaf Romano (gone)]

Well, not that complicated: The crash happens even if I try to get the parent of |a| in my testcase.

Comment 4

[Asaf Romano (gone)]

One more note: of course, we also crash when jsdIDebugger's jsParent is used (when calling getWrappedValue).

Comment 5

[Asaf Romano (gone)]

We crash when converting the returned value to string, not when getparent is called.  I guess this is related to the fact the returned value is exposed as an object (so says typeof), and not as a function.

Comment 6

[Robert Sayre]

Does it crash only in UniversalXPConnect, or did you just do that to get chrome privileges?

Comment 7

[Jeff Walden [:Waldo]]

http://whereswalden.com/2010/05/07/spidermonkey-change-du-jour-the-special-__parent__-property-has-been-removed/

"Beware: this method doesn’t censor like __parent__ does! Tread cautiously when using it where a With, Call, or Block object might be exposed, and don’t use the returned object except in immediate strict equality (===) checks. (NB: we’ve implemented it this way out of expediency; if it turns out to be too great a responsibility for typical testers, we’ll likely change it to censor.)"

You are failing here because you are getting an interesting getParent() value and not being careful in how you use it.  Unless we have evidence that this failure has happened more often than just this one time, I would mark this WONTFIX.

Comment 8

[David Mandelin [:dmandelin]]

This WFM in today's nightly.