Closed Bug 308641 Opened 19 years ago Closed 9 years ago

Setting a property with tinyID on an array object sets the array length to the tinyID

Categories

(Core :: JavaScript Engine, defect)

x86
Windows 2000
defect
Not set
normal

Tracking

()

RESOLVED WONTFIX
mozilla1.8beta5

People

(Reporter: steve, Unassigned)

Details

Attachments

(1 file)

User-Agent: Opera/8.02 (Windows NT 5.0; U; en) Build Identifier: If I have an object created with JS_NewArrayObject(), and then call JS_DefinePropertyWithTinyId() on it, supplying a positive tinyID, then the array length gets set to the value of the tinyID. This also occurs if I use JS_DefineProperties() with a props structure that features tinyIDs. Reproducible: Always Steps to Reproduce: 1.See Details. 2. 3. Actual Results: Array length of array object gets set to the value of the supplied tinyID/ shortID. Expected Results: Set a property on the array object that could be accessed using the tinyID. My previous SpiderMonkey build (from way back in 2001) allowed this. Brendan Eich tells me that I may be able to work around this by using negative tinyIDs, but I haven't tried this yet.
This is a fairly old API regression we should be able to fix easily. /be
Target Milestone: --- → mozilla1.8beta5
Flags: testcase-
Status: UNCONFIRMED → NEW
Ever confirmed: true
Flags: blocking1.9a1?
Flags: blocking1.8.1?
Flags: blocking1.8.0.1?
This does not appear to match the criteria for 1.8.0.1, and without a reviewed patch can't even hitch-hike as a "nice to have".
Flags: blocking1.8.0.1? → blocking1.8.0.1-
Flags: blocking1.8.1? → blocking1.8.1+
Igor any chance you can take a look?
Assignee: general → igor.bukanov
Given this is an old regression I'm pulling off the 1.8.1 blocker list. Please re-nom if you disagree.
Flags: blocking1.8.1+ → blocking1.8.1-
Flags: blocking1.9a1? → blocking1.9-
Whiteboard: [wanted-1.9]
If the array is larger than the tinyID, it doesn't appear to get truncated as a result of this bug. It -does- grow from 0 to whatever tinyID is, as in this sample.
On further consideration and after debugging for just a bit, is this really erroneous behavior? The tinyid is simply being used as the array index (growing the array, if necessary). Is that bad? What is the expected behavior?
I am not working on the bug right now.
Assignee: igor → general
Flags: wanted1.9+
Whiteboard: [wanted-1.9]
Assignee: general → nobody
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: