Closed Bug 1170216 Opened 10 years ago Closed 10 years ago

When using the slow-and-standard path in js::SetIntegrityLevel, don't manually call setNonwritableArrayLength afterwards

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla42
Tracking Status
firefox42 --- fixed

People

(Reporter: jorendorff, Assigned: jorendorff)

References

Details

Attachments

(1 file)

We have this hack: // Ordinarily ArraySetLength handles this, but we're going behind its back // right now, so we must do this manually. Neither the custom property // tree mutations nor the DefineProperty call in the above code will do // this for us. // // ArraySetLength also implements the capacity <= length invariant for // arrays with non-writable length. We don't need to do anything special // for that, because capacity was zeroed out by preventExtensions. (See // the assertion before the if-else above.) if (level == IntegrityLevel::Frozen && obj->is<ArrayObject>()) { if (!obj->as<ArrayObject>().maybeCopyElementsForWrite(cx)) return false; obj->as<ArrayObject>().getElementsHeader()->setNonwritableArrayLength(); } This is no longer necessary in the case where we go through DefineProperty, because with bug 1125624, DefineProperty now has standard behavior. That is: the part of the comment quoted above that refers to DefineProperty is now wrong.
Depends on: 1125624
Assignee: nobody → jorendorff
Status: NEW → ASSIGNED
Attachment #8613593 - Flags: review?(jwalden+bmo) → review+
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla42
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: