334807 - arguments object affected by assignment to Object

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Andreas]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.3) Gecko/20040914 (not Googlebot)
Build Identifier: CVS js

Followup to bug 304376:

The arguments object is still affected by assignment to Object.

ECMA 262-3 says (10.1.8):

  The value of the internal [[Prototype]] property of the arguments object is
  the original Object prototype object, the one that is the initial value of
  Object.prototype (section 15.2.3.1).


Reproducible: Always

Steps to Reproduce:
js> 0, function () { return arguments.join() }( 1, 2, 3 );
typein:1: TypeError: arguments.join is not a function
js> Object= Array, function () { return arguments.join() }( 1, 2, 3 );
1,2,3



Expected Results:  
Should still throw TypeError.

Comment 1

[Andreas]

Error objects are affected, too:

js> try{x.y}catch(e){e.valueOf()}
ReferenceError: x is not defined
js> Error= Number
function Number() {
    [native code]
}
js> try{x.y}catch(e){e.valueOf()}
typein:3: TypeError: Number.prototype.valueOf called on incompatible Error

Don't know if this should be a different bug.

Comment 2

[Brendan Eich [:brendan]]

Taking, I'll fix Error and any others in the same patch.

/be

Comment 3

[Brendan Eich [:brendan]]

Attachment: fix

Comment 4

[Brendan Eich [:brendan]]

Fixed.

/be

Comment 5

[Bob Clary [:bc] (inactive)]

RCS file: /cvsroot/mozilla/js/tests/js1_5/Regress/regress-334807-01.js,v
done
Checking in js1_5/Regress/regress-334807-01.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-334807-01.js,v  <--  regress-334
807-01.js
initial revision: 1.1
done
RCS file: /cvsroot/mozilla/js/tests/js1_5/Regress/regress-334807-02.js,v
done
Checking in js1_5/Regress/regress-334807-02.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-334807-02.js,v  <--  regress-334
807-02.js
initial revision: 1.1
done
RCS file: /cvsroot/mozilla/js/tests/js1_5/Regress/regress-334807-03.js,v
done
Checking in js1_5/Regress/regress-334807-03.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-334807-03.js,v  <--  regress-334
807-03.js
initial revision: 1.1
done
RCS file: /cvsroot/mozilla/js/tests/js1_5/Regress/regress-334807-04.js,v
done
Checking in js1_5/Regress/regress-334807-04.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-334807-04.js,v  <--  regress-334
807-04.js
initial revision: 1.1
done
RCS file: /cvsroot/mozilla/js/tests/js1_5/Regress/regress-334807-05.js,v
done
Checking in js1_5/Regress/regress-334807-05.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-334807-05.js,v  <--  regress-334
807-05.js
initial revision: 1.1
done
RCS file: /cvsroot/mozilla/js/tests/js1_5/Regress/regress-334807-06.js,v
done
Checking in js1_5/Regress/regress-334807-06.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-334807-06.js,v  <--  regress-334
807-06.js
initial revision: 1.1
done

on windows: shell has no failures, but browser fails 02, 04

Comment 6

[Brendan Eich [:brendan]]

Fails how, what does the printStatus show as the result of arguments.join()?

Since this works in the shell, I'd like to close the bug again.  A followup bug would be better, since the core engine bug is in fact fixed.

/be

Comment 7

[Bob Clary [:bc] (inactive)]

(In reply to comment #6)

Filed Bug 335267

Comment 8

[Bob Clary [:bc] (inactive)]

verified fixed 20060609 win/macppc/linux trunk shell.

Comment 9

[Bob Clary [:bc] (inactive)]

fixed by Bug 336373 on the 1.8.1 branch. 
verified fixed 1.8.1 with windows/macppc/linux 20060707