Closed
Bug 336100
Opened 18 years ago
Closed 18 years ago
Attributes to var arguments = window.arguments[0]; give void an evaluation [Can't create new sub folder]
Categories
(Core :: JavaScript Engine, defect, P2)
Core
JavaScript Engine
Tracking
()
VERIFIED
FIXED
mozilla1.9alpha1
People
(Reporter: iannbugzilla, Assigned: mrbkap)
References
()
Details
(Keywords: regression, Whiteboard: [partial patch])
Attachments
(1 file, 1 obsolete file)
1006 bytes,
patch
|
mrbkap
:
review+
|
Details | Diff | Splinter Review |
Using both SM1.5a and Tb3.0a1 BuildID 2006042710 and later fail to evaluate attributes to anything other than void with: In an onLoad function you have var arguments = window.arguments[0]; then try to evaluate any of the attributes you get void than the actual value, in this case something like arguments.preselectedURI If you change it to: var args = window.arguments[0]; then args.preselectedURI gives the correct value. Works fine in BuildID 2006042610 and is still broken in BuildID 2006043011
This fortunately only seems to impact on 3 files, all in mailnews - http://lxr.mozilla.org/seamonkey/search?string=arguments+%3D+window.arguments Regression window is http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-04-26+10%3A00&maxdate=2006-04-27+10%3A00&cvsroot=%2Fcvsroot I suspect one of brendan's checkins for bug 326466
There are a fair number of changes in that window that could be at fault, by subtly changing the behaviour of var-overriding-property or something similar. I presume there are no relevant strict warnings presented. Can you narrow the regression range some more? Could be something about how 333697 affects window setup, maybe?
Bug 335964 which seems to have the same cause narrows the window down to bug 325951
Can someone try backing that patch (and its follow-ons, natch) out locally and confirming? If that's the regression cause, please mark this bug as blocking it.
Comment 5•18 years ago
|
||
Adding the bug whose fix caused this one (I really think *deppends* has other meaning: if one gets fixed the other will also...).
Comment 6•18 years ago
|
||
For comment 5, Mike: I couldn't find any point where I can build fixing the brendan fixes. Off course I haven't tried every possible point, hehe. So adding this to the bug deppendent on 325951 list will help us finding what caused the issues. (He already worked to fix a bug in the Pythoniac lists, see in the bug).
Comment 7•18 years ago
|
||
*** Bug 335964 has been marked as a duplicate of this bug. ***
Comment 8•18 years ago
|
||
With a 20060429 build: <http://test.bclary.com/tests/mozilla.org/js/js-test-driver-standards.html?test=ecma/ExecutionContexts/10.1.6.js;language=language;javascript> 10.1.6 Activation Object (new TestObject(0,1,2,3,4,5)).length = 6 PASSED! (new TestObject(0,1,2,3,4,5))[0] = 0 PASSED! (new TestObject(0,1,2,3,4,5))[1] = 1 PASSED! (new TestObject(0,1,2,3,4,5))[2] = 2 PASSED! (new TestObject(0,1,2,3,4,5))[3] = 3 PASSED! (new TestObject(0,1,2,3,4,5))[4] = 4 PASSED! (new TestObject(0,1,2,3,4,5))[5] = 5 PASSED! (new AnotherTestObject(1,2,3)).arguments = value of the argument property PASSED! TestFunction(1,2,3) = [object Object] FAILED! expected: value of the argument property
Assignee | ||
Updated•18 years ago
|
Priority: -- → P2
Whiteboard: [partial patch]
Target Milestone: --- → mozilla1.9alpha
Assignee | ||
Comment 9•18 years ago
|
||
This patch works, but alas -- note the commented out ex-MLM assertion. I'm attaching this here for safekeeping. I'll try to track down why the MLM assertion fires in not-too-long.
Assignee: general → mrbkap
Status: NEW → ASSIGNED
Comment 10•18 years ago
|
||
*** Bug 336473 has been marked as a duplicate of this bug. ***
Comment 11•18 years ago
|
||
*** Bug 336522 has been marked as a duplicate of this bug. ***
Assignee | ||
Comment 12•18 years ago
|
||
Comment on attachment 220720 [details] [diff] [review] Partial patch This has a couple of pretty major problems.
Attachment #220720 -
Attachment is obsolete: true
Comment 13•18 years ago
|
||
*** Bug 337125 has been marked as a duplicate of this bug. ***
Smaller test case, courtesy of Jim Grandy in dev-tech-js-engine: js> (function(){print(arguments);})() [object Object] js> (function(){with (this) print(arguments);})() js>
Comment 15•18 years ago
|
||
Checking in regress-336100.js; /cvsroot/mozilla/js/tests/js1_5/Regress/regress-336100.js,v <-- regress-336100.js initial revision: 1.1
Flags: in-testsuite+
Comment 16•18 years ago
|
||
Can someone please add "Can't create new sub folder" (or similar) to the summary - to prevent the dupes from raining in. The current summary is pretty cryptic for all but the "inner circle".
Comment 17•18 years ago
|
||
added "Can't create new sub folder" to summary for search goodness.
Summary: Attributes to var arguments = window.arguments[0]; give void an evaluation → Attributes to var arguments = window.arguments[0]; give void an evaluation [Can't create new sub folder]
Assignee | ||
Updated•18 years ago
|
Assignee | ||
Comment 18•18 years ago
|
||
Attachment #221657 -
Flags: review+
Assignee | ||
Comment 19•18 years ago
|
||
I checked the hack in, so this bug should be fixed.
Status: ASSIGNED → RESOLVED
Closed: 18 years ago
Resolution: --- → FIXED
Comment 20•18 years ago
|
||
Is there a bug tracking the removal of JSCLASS_IS_ANONYMOUS from js_CallClass? /be
Assignee | ||
Comment 21•18 years ago
|
||
(In reply to comment #20) > Is there a bug tracking the removal of JSCLASS_IS_ANONYMOUS from js_CallClass? I filed bug 337528 on the base issue, so I'll add the flag back in that bug.
Comment 22•18 years ago
|
||
I could verify this with (compiled by me, if it matters): Mozilla/5.0 (X11; U; Linux i686; pt-BR; rv:1.9a1) Gecko/20060511 SeaMonkey/1.5a So marking as verified. It also doesn't fall back to the IMAP dialog for creting folders... So everything is fine here.
Status: RESOLVED → VERIFIED
Comment 23•18 years ago
|
||
js1_5/Regress/regress-336100.js is still failing in the shell only for 1.8.0.4, 1.8.1, 1.9 with Expected value '[object Object]', Actual value ''
Comment 24•18 years ago
|
||
(In reply to comment #23) > js1_5/Regress/regress-336100.js is still failing in the shell only for 1.8.0.4, > 1.8.1, 1.9 with Expected value '[object Object]', Actual value '' > "Attributes to var arguments = window.arguments[0]; give void an evaluation [Can't create new sub folder]". Both doesn't happen anymore. Try this in the browser javascript console: alert((function(){with (this) return arguments;})()) Is there something going wrong with the shell?
Comment 25•18 years ago
|
||
(In reply to comment #24) > > > Try this in the browser javascript console: > alert((function(){with (this) return arguments;})()) same as in the browser tests '[object Object]' browser: ((function(){with (this) return arguments + '';})()) === '[object Object]' but in the shell ((function(){with (this) return arguments + '';})()) === ''
Comment 26•18 years ago
|
||
With js 1.5: js> ((function(){with (this) return arguments + '';})()) js> var arguments = new function() {} js> ((function(){with (this) return arguments + '';})()) [object Object] js> With the trunk shell: js> ((function(){with (this) return arguments + '';})()) js> var arguments = new function() {} js> ((function(){with (this) return arguments + '';})()) [object Object] js> ((function(){with (this) print(arguments) + '';})()) [object Object] js> So this is quite an old behaviour... Are you sure it's a bug? (I know it's a test case for the regression, I'm questioning it)
Comment 27•18 years ago
|
||
I don't know which is why I haven't reopened the bug. Blake or Brendan can make the call.
Comment 28•18 years ago
|
||
(In reply to comment #25) > browser: > ((function(){with (this) return arguments + '';})()) === '[object Object]' > but in the shell > ((function(){with (this) return arguments + '';})()) === '' This is expected. Note that the same bytecode is generated for a given source, so the function is interpreted the same in both shell and browsers. Therefore what differs must be the meaning of arguments. In both calls, arguments is found in the scope chain head set by the with statement, so in the |this| parameter. But in the shell, this.arguments is an Array created by js.c. An empty array converts to the empty string. In the browser, for content windows, there is no window.arguments predefined by the DOM environment (as there is for chrome windows). So the with extension to the scope chain for |this| does not contain an 'arguments' property, and the search for that identifier continues up to the activation object for the function, where 'arguments' is indeed bound per ECMA-262 to an array-like object that seems to be of Object class. /be
Comment 29•18 years ago
|
||
(In reply to comment #28) > In both calls, arguments is > found in the scope chain head set by the with statement, so in the |this| > parameter. But in the shell, this.arguments is an Array created by js.c. An > empty array converts to the empty string. Argh, garbled the two sentences here. Obviously I meant that arguments is found in the scope chain in both cases, but in the shell it's found in the |this| object named by the with. In the browser, it is not found there, so the search finds it in the activation object. /be
Comment 30•18 years ago
|
||
Checking in regress-336100.js; /cvsroot/mozilla/js/tests/js1_5/Regress/regress-336100.js,v <-- regress-336100.js new revision: 1.2; previous revision: 1.1 done
You need to log in
before you can comment on or make changes to this bug.
Description
•