Closed Bug 336100 Opened 18 years ago Closed 18 years ago

Attributes to var arguments = window.arguments[0]; give void an evaluation [Can't create new sub folder]

Categories

(Core :: JavaScript Engine, defect, P2)

defect

Tracking

()

VERIFIED FIXED
mozilla1.9alpha1

People

(Reporter: iannbugzilla, Assigned: mrbkap)

References

()

Details

(Keywords: regression, Whiteboard: [partial patch])

Attachments

(1 file, 1 obsolete file)

Using both SM1.5a and Tb3.0a1 BuildID 2006042710 and later fail to evaluate attributes to anything other than void with:
In an onLoad function you have
var arguments = window.arguments[0];
then try to evaluate any of the attributes you get void than the actual value, in this case something like arguments.preselectedURI
If you change it to:
var args = window.arguments[0];
then args.preselectedURI gives the correct value.

Works fine in BuildID 2006042610 and is still broken in BuildID 2006043011
There are a fair number of changes in that window that could be at fault, by subtly changing the behaviour of var-overriding-property or something similar.  I presume there are no relevant strict warnings presented.

Can you narrow the regression range some more?  Could be something about how 333697 affects window setup, maybe?
Bug 335964 which seems to have the same cause narrows the window down to bug 325951
Can someone try backing that patch (and its follow-ons, natch) out locally and confirming?  If that's the regression cause, please mark this bug as blocking it.
Adding the bug whose fix caused this one (I really think *deppends* has other meaning: if one gets fixed the other will also...).

No longer blocks: 335964
Depends on: 325951
For comment 5, Mike:

I couldn't find any point where I can build fixing the brendan fixes.
Off course I haven't tried every possible point, hehe.

So adding this to the bug deppendent on 325951 list will help us finding what caused the issues.

(He already worked to fix a bug in the Pythoniac lists, see in the bug).

*** Bug 335964 has been marked as a duplicate of this bug. ***
With a 20060429 build: <http://test.bclary.com/tests/mozilla.org/js/js-test-driver-standards.html?test=ecma/ExecutionContexts/10.1.6.js;language=language;javascript>

10.1.6 Activation Object
(new TestObject(0,1,2,3,4,5)).length = 6   PASSED!
(new TestObject(0,1,2,3,4,5))[0] = 0   PASSED!
(new TestObject(0,1,2,3,4,5))[1] = 1   PASSED!
(new TestObject(0,1,2,3,4,5))[2] = 2   PASSED!
(new TestObject(0,1,2,3,4,5))[3] = 3   PASSED!
(new TestObject(0,1,2,3,4,5))[4] = 4   PASSED!
(new TestObject(0,1,2,3,4,5))[5] = 5   PASSED!
(new AnotherTestObject(1,2,3)).arguments = value of the argument property   PASSED!
TestFunction(1,2,3) = [object Object]  FAILED! expected: value of the argument property
Priority: -- → P2
Whiteboard: [partial patch]
Target Milestone: --- → mozilla1.9alpha
Attached patch Partial patch (obsolete) — Splinter Review
This patch works, but alas -- note the commented out ex-MLM assertion. I'm attaching this here for safekeeping. I'll try to track down why the MLM assertion fires in not-too-long.
Assignee: general → mrbkap
Status: NEW → ASSIGNED
*** Bug 336473 has been marked as a duplicate of this bug. ***
*** Bug 336522 has been marked as a duplicate of this bug. ***
Comment on attachment 220720 [details] [diff] [review]
Partial patch

This has a couple of pretty major problems.
Attachment #220720 - Attachment is obsolete: true
*** Bug 337125 has been marked as a duplicate of this bug. ***
Smaller test case, courtesy of Jim Grandy in dev-tech-js-engine:

js> (function(){print(arguments);})()
[object Object]
js> (function(){with (this) print(arguments);})()

js>
Checking in regress-336100.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-336100.js,v  <--  regress-336100.js
initial revision: 1.1
Flags: in-testsuite+
Can someone please add "Can't create new sub folder" (or similar) to the summary - to prevent the dupes from raining in. The current summary is pretty cryptic for all but the "inner circle".
added "Can't create new sub folder" to summary for search goodness.
Summary: Attributes to var arguments = window.arguments[0]; give void an evaluation → Attributes to var arguments = window.arguments[0]; give void an evaluation [Can't create new sub folder]
Blocks: 325951
No longer depends on: 325951
Attached patch HackSplinter Review
Attachment #221657 - Flags: review+
I checked the hack in, so this bug should be fixed.
Status: ASSIGNED → RESOLVED
Closed: 18 years ago
Resolution: --- → FIXED
Is there a bug tracking the removal of JSCLASS_IS_ANONYMOUS from js_CallClass?

/be
(In reply to comment #20)
> Is there a bug tracking the removal of JSCLASS_IS_ANONYMOUS from js_CallClass?

I filed bug 337528 on the base issue, so I'll add the flag back in that bug.
I could verify this with (compiled by me, if it matters):
Mozilla/5.0 (X11; U; Linux i686; pt-BR; rv:1.9a1) Gecko/20060511 SeaMonkey/1.5a


So marking as verified.


It also doesn't fall back to the IMAP dialog for creting folders...
So everything is fine here.
Status: RESOLVED → VERIFIED
Blocks: 336750
Blocks: 336773
Blocks: 336776
Blocks: 336782
js1_5/Regress/regress-336100.js is still failing in the shell only for 1.8.0.4, 1.8.1, 1.9 with  Expected value '[object Object]', Actual value ''
(In reply to comment #23)
> js1_5/Regress/regress-336100.js is still failing in the shell only for 1.8.0.4,
> 1.8.1, 1.9 with  Expected value '[object Object]', Actual value ''
> 

"Attributes to var arguments = window.arguments[0]; give void an evaluation [Can't create new sub folder]".

Both doesn't happen anymore.


Try this in the browser javascript console:
alert((function(){with (this) return arguments;})())

Is there something going wrong with the shell?
(In reply to comment #24)
>
> 
> Try this in the browser javascript console:
> alert((function(){with (this) return arguments;})())

same as in the browser tests '[object Object]' 

browser: 
((function(){with (this) return arguments + '';})()) === '[object Object]'
but in the shell
((function(){with (this) return arguments + '';})())  === ''
With js 1.5:

js> ((function(){with (this) return arguments + '';})())

js> var arguments = new function() {}
js>  ((function(){with (this) return arguments + '';})())
[object Object]
js>

With the trunk shell:
js> ((function(){with (this) return arguments + '';})())

js>  var arguments = new function() {}
js>   ((function(){with (this) return arguments + '';})())
[object Object]
js> ((function(){with (this) print(arguments) + '';})())
[object Object]
js>



So this is quite an old behaviour...
Are you sure it's a bug?
(I know it's a test case for the regression, I'm questioning it)
I don't know which is why I haven't reopened the bug. Blake or Brendan can make the call.
(In reply to comment #25)
> browser: 
> ((function(){with (this) return arguments + '';})()) === '[object Object]'
> but in the shell
> ((function(){with (this) return arguments + '';})())  === ''

This is expected.  Note that the same bytecode is generated for a given source, so the function is interpreted the same in both shell and browsers.  Therefore what differs must be the meaning of arguments.  In both calls, arguments is found in the scope chain head set by the with statement, so in the |this| parameter.  But in the shell, this.arguments is an Array created by js.c.  An empty array converts to the empty string.

In the browser, for content windows, there is no window.arguments predefined by the DOM environment (as there is for chrome windows).  So the with extension to the scope chain for |this| does not contain an 'arguments' property, and the search for that identifier continues up to the activation object for the function, where 'arguments' is indeed bound per ECMA-262 to an array-like object that seems to be of Object class.

/be
(In reply to comment #28)
> In both calls, arguments is
> found in the scope chain head set by the with statement, so in the |this|
> parameter.  But in the shell, this.arguments is an Array created by js.c.  An
> empty array converts to the empty string.

Argh, garbled the two sentences here.  Obviously I meant that arguments is found in the scope chain in both cases, but in the shell it's found in the |this| object named by the with.  In the browser, it is not found there, so the search finds it in the activation object.

/be
Checking in regress-336100.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-336100.js,v  <--  regress-336100.js
new revision: 1.2; previous revision: 1.1
done
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: