Closed Bug 338307 Opened 16 years ago Closed 16 years ago

for (i in arguments) causes type error (JS_1_7_ALPHA_BRANCH)

Categories

(Core :: JavaScript Engine, defect, P2)

defect

Tracking

()

VERIFIED FIXED
mozilla1.9alpha1

People

(Reporter: nanto, Assigned: mrbkap)

References

Details

(Whiteboard: [patch])

Attachments

(1 file)

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; ja; rv:1.8.0.3) Gecko/20060426 Firefox/1.5.0.3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; ja; rv:1.8.0.3) Gecko/20060426 Firefox/1.5.0.3

A for...in statement for arguments object causes type error.
This bug occurs only in JS_1_7_ALPHA_BRANCH, not in trunk.

Reproducible: Always

Steps to Reproduce:
Evaluate the script in JS shell:

function f() {
  for (var i in arguments);
}
f();

Actual Results:  
typein:1: TypeError: i is not a function


Expected Results:  
Nothing happens.
Now, a type error doesn't occur but the following assertion is shown and going into infinite loop.

js> function f() {for (var i in arguments);}
js> f();
Assertion failure: (uint32)(3 + 1) < JS_MIN(((iterobj)->map)->freeslot, ((iterobj)->map)->nslots), at jsiter.c:318
I can't reproduce that problem with my patch for this bug and brendan claims that he passed the whole testsuite before he checked in anyway, so it's unlikely that those two problems are the same.
Blocks: geniter
Status: UNCONFIRMED → NEW
Ever confirmed: true
OS: Windows XP → All
Priority: -- → P2
Hardware: PC → All
Whiteboard: [patch]
Target Milestone: --- → mozilla1.9alpha
Attached patch FixSplinter Review
r=brendan looking over my shoulder. I'll get this in on the trunk and JS_1_7_ALPHA_BRANCH asap.
Assignee: general → mrbkap
Status: NEW → ASSIGNED
Attachment #223222 - Flags: review+
Fix checked into the trunk and JS_1_7_ALPHA_BRANCH.
Status: ASSIGNED → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
RCS file: /cvsroot/mozilla/js/tests/js1_5/Regress/regress-338307.js,v
done
Checking in regress-338307.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-338307.js,v  <--  regress-338307.js
initial revision: 1.1
Flags: in-testsuite+
verified fixed 1.9 window/mac(ppc|tel)/linux 20060810
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.