Attributes to var arguments = window.arguments[0]; give void an evaluation [Can't create new sub folder]

VERIFIED FIXED in mozilla1.9alpha1

Status

()

P2
blocker
VERIFIED FIXED
13 years ago
13 years ago

People

(Reporter: iann_bugzilla, Assigned: mrbkap)

Tracking

({regression})

Trunk
mozilla1.9alpha1
regression
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [partial patch], URL)

Attachments

(1 attachment, 1 obsolete attachment)

(Reporter)

Description

13 years ago
Using both SM1.5a and Tb3.0a1 BuildID 2006042710 and later fail to evaluate attributes to anything other than void with:
In an onLoad function you have
var arguments = window.arguments[0];
then try to evaluate any of the attributes you get void than the actual value, in this case something like arguments.preselectedURI
If you change it to:
var args = window.arguments[0];
then args.preselectedURI gives the correct value.

Works fine in BuildID 2006042610 and is still broken in BuildID 2006043011
There are a fair number of changes in that window that could be at fault, by subtly changing the behaviour of var-overriding-property or something similar.  I presume there are no relevant strict warnings presented.

Can you narrow the regression range some more?  Could be something about how 333697 affects window setup, maybe?
(Reporter)

Comment 3

13 years ago
Bug 335964 which seems to have the same cause narrows the window down to bug 325951
Can someone try backing that patch (and its follow-ons, natch) out locally and confirming?  If that's the regression cause, please mark this bug as blocking it.
Blocks: 335964
Adding the bug whose fix caused this one (I really think *deppends* has other meaning: if one gets fixed the other will also...).

No longer blocks: 335964
Depends on: 325951
For comment 5, Mike:

I couldn't find any point where I can build fixing the brendan fixes.
Off course I haven't tried every possible point, hehe.

So adding this to the bug deppendent on 325951 list will help us finding what caused the issues.

(He already worked to fix a bug in the Pythoniac lists, see in the bug).

*** Bug 335964 has been marked as a duplicate of this bug. ***

Comment 8

13 years ago
With a 20060429 build: <http://test.bclary.com/tests/mozilla.org/js/js-test-driver-standards.html?test=ecma/ExecutionContexts/10.1.6.js;language=language;javascript>

10.1.6 Activation Object
(new TestObject(0,1,2,3,4,5)).length = 6   PASSED!
(new TestObject(0,1,2,3,4,5))[0] = 0   PASSED!
(new TestObject(0,1,2,3,4,5))[1] = 1   PASSED!
(new TestObject(0,1,2,3,4,5))[2] = 2   PASSED!
(new TestObject(0,1,2,3,4,5))[3] = 3   PASSED!
(new TestObject(0,1,2,3,4,5))[4] = 4   PASSED!
(new TestObject(0,1,2,3,4,5))[5] = 5   PASSED!
(new AnotherTestObject(1,2,3)).arguments = value of the argument property   PASSED!
TestFunction(1,2,3) = [object Object]  FAILED! expected: value of the argument property
(Assignee)

Updated

13 years ago
Priority: -- → P2
Whiteboard: [partial patch]
Target Milestone: --- → mozilla1.9alpha
(Assignee)

Comment 9

13 years ago
Created attachment 220720 [details] [diff] [review]
Partial patch

This patch works, but alas -- note the commented out ex-MLM assertion. I'm attaching this here for safekeeping. I'll try to track down why the MLM assertion fires in not-too-long.
Assignee: general → mrbkap
Status: NEW → ASSIGNED
Blocks: 336473
*** Bug 336473 has been marked as a duplicate of this bug. ***
*** Bug 336522 has been marked as a duplicate of this bug. ***
(Assignee)

Comment 12

13 years ago
Comment on attachment 220720 [details] [diff] [review]
Partial patch

This has a couple of pretty major problems.
Attachment #220720 - Attachment is obsolete: true
*** Bug 337125 has been marked as a duplicate of this bug. ***
Smaller test case, courtesy of Jim Grandy in dev-tech-js-engine:

js> (function(){print(arguments);})()
[object Object]
js> (function(){with (this) print(arguments);})()

js>

Comment 15

13 years ago
Checking in regress-336100.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-336100.js,v  <--  regress-336100.js
initial revision: 1.1
Flags: in-testsuite+

Comment 16

13 years ago
Can someone please add "Can't create new sub folder" (or similar) to the summary - to prevent the dupes from raining in. The current summary is pretty cryptic for all but the "inner circle".

Comment 17

13 years ago
added "Can't create new sub folder" to summary for search goodness.
Summary: Attributes to var arguments = window.arguments[0]; give void an evaluation → Attributes to var arguments = window.arguments[0]; give void an evaluation [Can't create new sub folder]
(Assignee)

Updated

13 years ago
Blocks: 325951
No longer depends on: 325951
(Assignee)

Comment 18

13 years ago
Created attachment 221657 [details] [diff] [review]
Hack
Attachment #221657 - Flags: review+
(Assignee)

Comment 19

13 years ago
I checked the hack in, so this bug should be fixed.
Status: ASSIGNED → RESOLVED
Last Resolved: 13 years ago
Resolution: --- → FIXED
Is there a bug tracking the removal of JSCLASS_IS_ANONYMOUS from js_CallClass?

/be
(Assignee)

Comment 21

13 years ago
(In reply to comment #20)
> Is there a bug tracking the removal of JSCLASS_IS_ANONYMOUS from js_CallClass?

I filed bug 337528 on the base issue, so I'll add the flag back in that bug.
I could verify this with (compiled by me, if it matters):
Mozilla/5.0 (X11; U; Linux i686; pt-BR; rv:1.9a1) Gecko/20060511 SeaMonkey/1.5a


So marking as verified.


It also doesn't fall back to the IMAP dialog for creting folders...
So everything is fine here.
Status: RESOLVED → VERIFIED

Updated

13 years ago
Blocks: 336750

Updated

13 years ago
Blocks: 336773

Updated

13 years ago
Blocks: 336776

Updated

13 years ago
Blocks: 336782

Comment 23

13 years ago
js1_5/Regress/regress-336100.js is still failing in the shell only for 1.8.0.4, 1.8.1, 1.9 with  Expected value '[object Object]', Actual value ''
(In reply to comment #23)
> js1_5/Regress/regress-336100.js is still failing in the shell only for 1.8.0.4,
> 1.8.1, 1.9 with  Expected value '[object Object]', Actual value ''
> 

"Attributes to var arguments = window.arguments[0]; give void an evaluation [Can't create new sub folder]".

Both doesn't happen anymore.


Try this in the browser javascript console:
alert((function(){with (this) return arguments;})())

Is there something going wrong with the shell?

Comment 25

13 years ago
(In reply to comment #24)
>
> 
> Try this in the browser javascript console:
> alert((function(){with (this) return arguments;})())

same as in the browser tests '[object Object]' 

browser: 
((function(){with (this) return arguments + '';})()) === '[object Object]'
but in the shell
((function(){with (this) return arguments + '';})())  === ''
With js 1.5:

js> ((function(){with (this) return arguments + '';})())

js> var arguments = new function() {}
js>  ((function(){with (this) return arguments + '';})())
[object Object]
js>

With the trunk shell:
js> ((function(){with (this) return arguments + '';})())

js>  var arguments = new function() {}
js>   ((function(){with (this) return arguments + '';})())
[object Object]
js> ((function(){with (this) print(arguments) + '';})())
[object Object]
js>



So this is quite an old behaviour...
Are you sure it's a bug?
(I know it's a test case for the regression, I'm questioning it)

Comment 27

13 years ago
I don't know which is why I haven't reopened the bug. Blake or Brendan can make the call.
(In reply to comment #25)
> browser: 
> ((function(){with (this) return arguments + '';})()) === '[object Object]'
> but in the shell
> ((function(){with (this) return arguments + '';})())  === ''

This is expected.  Note that the same bytecode is generated for a given source, so the function is interpreted the same in both shell and browsers.  Therefore what differs must be the meaning of arguments.  In both calls, arguments is found in the scope chain head set by the with statement, so in the |this| parameter.  But in the shell, this.arguments is an Array created by js.c.  An empty array converts to the empty string.

In the browser, for content windows, there is no window.arguments predefined by the DOM environment (as there is for chrome windows).  So the with extension to the scope chain for |this| does not contain an 'arguments' property, and the search for that identifier continues up to the activation object for the function, where 'arguments' is indeed bound per ECMA-262 to an array-like object that seems to be of Object class.

/be
(In reply to comment #28)
> In both calls, arguments is
> found in the scope chain head set by the with statement, so in the |this|
> parameter.  But in the shell, this.arguments is an Array created by js.c.  An
> empty array converts to the empty string.

Argh, garbled the two sentences here.  Obviously I meant that arguments is found in the scope chain in both cases, but in the shell it's found in the |this| object named by the with.  In the browser, it is not found there, so the search finds it in the activation object.

/be

Comment 30

13 years ago
Checking in regress-336100.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-336100.js,v  <--  regress-336100.js
new revision: 1.2; previous revision: 1.1
done
You need to log in before you can comment on or make changes to this bug.