Closed
Bug 308641
Opened 19 years ago
Closed 9 years ago
Setting a property with tinyID on an array object sets the array length to the tinyID
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
WONTFIX
mozilla1.8beta5
People
(Reporter: steve, Unassigned)
Details
Attachments
(1 file)
483 bytes,
text/plain
|
Details |
User-Agent: Opera/8.02 (Windows NT 5.0; U; en)
Build Identifier:
If I have an object created with JS_NewArrayObject(), and then call
JS_DefinePropertyWithTinyId() on it, supplying a positive tinyID, then the array
length gets set to the value of the tinyID. This also occurs if I use
JS_DefineProperties() with a props structure that features tinyIDs.
Reproducible: Always
Steps to Reproduce:
1.See Details.
2.
3.
Actual Results:
Array length of array object gets set to the value of the supplied tinyID/
shortID.
Expected Results:
Set a property on the array object that could be accessed using the tinyID. My
previous SpiderMonkey build (from way back in 2001) allowed this.
Brendan Eich tells me that I may be able to work around this by using negative
tinyIDs, but I haven't tried this yet.
Comment 1•19 years ago
|
||
This is a fairly old API regression we should be able to fix easily.
/be
Target Milestone: --- → mozilla1.8beta5
Updated•19 years ago
|
Flags: testcase-
Updated•19 years ago
|
Status: UNCONFIRMED → NEW
Ever confirmed: true
Flags: blocking1.9a1?
Flags: blocking1.8.1?
Flags: blocking1.8.0.1?
Comment 2•19 years ago
|
||
This does not appear to match the criteria for 1.8.0.1, and without a reviewed patch can't even hitch-hike as a "nice to have".
Flags: blocking1.8.0.1? → blocking1.8.0.1-
Updated•19 years ago
|
Flags: blocking1.8.1? → blocking1.8.1+
Comment 3•19 years ago
|
||
Igor any chance you can take a look?
Updated•19 years ago
|
Assignee: general → igor.bukanov
Comment 4•19 years ago
|
||
Given this is an old regression I'm pulling off the 1.8.1 blocker list. Please re-nom if you disagree.
Flags: blocking1.8.1+ → blocking1.8.1-
Updated•18 years ago
|
Flags: blocking1.9a1? → blocking1.9-
Whiteboard: [wanted-1.9]
Comment 5•18 years ago
|
||
If the array is larger than the tinyID, it doesn't appear to get truncated as a result of this bug. It -does- grow from 0 to whatever tinyID is, as in this sample.
Comment 6•18 years ago
|
||
On further consideration and after debugging for just a bit, is this really erroneous behavior? The tinyid is simply being used as the array index (growing the array, if necessary). Is that bad? What is the expected behavior?
Updated•17 years ago
|
Flags: wanted1.9+
Whiteboard: [wanted-1.9]
Assignee | ||
Updated•10 years ago
|
Assignee: general → nobody
Comment 8•9 years ago
|
||
tinyId was removed in http://hg.mozilla.org/mozilla-central/rev/4027d48cbc51 (bug 975069)
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → WONTFIX
You need to log in
before you can comment on or make changes to this bug.
Description
•