338307 - for (i in arguments) causes type error (JS_1_7_ALPHA_BRANCH)

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[nanto_vi (TOYAMA Nao)]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; ja; rv:1.8.0.3) Gecko/20060426 Firefox/1.5.0.3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; ja; rv:1.8.0.3) Gecko/20060426 Firefox/1.5.0.3

A for...in statement for arguments object causes type error.
This bug occurs only in JS_1_7_ALPHA_BRANCH, not in trunk.

Reproducible: Always

Steps to Reproduce:
Evaluate the script in JS shell:

function f() {
  for (var i in arguments);
}
f();

Actual Results:  
typein:1: TypeError: i is not a function


Expected Results:  
Nothing happens.

Comment 1

[Bob Clary [:bc] (inactive)]

dupe of bug 326466 comment 59 ?

Comment 2

[nanto_vi (TOYAMA Nao)]

Now, a type error doesn't occur but the following assertion is shown and going into infinite loop.

js> function f() {for (var i in arguments);}
js> f();
Assertion failure: (uint32)(3 + 1) < JS_MIN(((iterobj)->map)->freeslot, ((iterobj)->map)->nslots), at jsiter.c:318

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

I can't reproduce that problem with my patch for this bug and brendan claims that he passed the whole testsuite before he checked in anyway, so it's unlikely that those two problems are the same.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

r=brendan looking over my shoulder. I'll get this in on the trunk and JS_1_7_ALPHA_BRANCH asap.

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into the trunk and JS_1_7_ALPHA_BRANCH.

Comment 6

[Bob Clary [:bc] (inactive)]

RCS file: /cvsroot/mozilla/js/tests/js1_5/Regress/regress-338307.js,v
done
Checking in regress-338307.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-338307.js,v  <--  regress-338307.js
initial revision: 1.1

Comment 7

[Bob Clary [:bc] (inactive)]

verified fixed 1.9 window/mac(ppc|tel)/linux 20060810