[test262][ecma402] Tainting of "type" works in PluralRules.prototype.select

RESOLVED FIXED in Firefox 58

Status

()

enhancement
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: zbraniecki, Assigned: anba)

Tracking

unspecified
mozilla58
Points:
---

Firefox Tracking Flags

(firefox58 fixed)

Details

Attachments

(1 attachment)

test262 errors with:

## test262/intl402/PluralRules/prototype/select/tainting.js: rc = 3, run time = 0.058382
uncaught exception: Test262Error: Client code can adversely affect behavior: setter for type.
The setter is called from the test harness itself (http://searchfox.org/mozilla-central/rev/7cb75d87753de9103253e34bc85592e26378f506/js/src/tests/shell.js#458). :-/
Assignee: nobody → andrebargull
I guess the easiest way to fix this issue, is to make TestCase.prototype no longer inherit from Object.prototype. And I've also changed the TestCase constructor to simply call the existing ArrayPush helper instead of calling ObjectDefineProperty manually.
Attachment #8924600 - Flags: review?(jwalden+bmo)
Comment on attachment 8924600 [details] [diff] [review]
bug1346080.patch

Review of attachment 8924600 [details] [diff] [review]:
-----------------------------------------------------------------

TestCase remains abominable over-engineering, but this is exactly why I started all this IIFE business so long ago.  Great to see it coming to useful fruition, and so easily, too!
Attachment #8924600 - Flags: review?(jwalden+bmo) → review+
Pushed by ryanvm@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/908c36075a85
Make jstests TestCase object resilient against Object.prototype changes. r=Waldo
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/908c36075a85
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla58
You need to log in before you can comment on or make changes to this bug.