425504 - js_InitFunctionClass doesn't make Function.prototype a JSFunction

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[Jason Orendorff [:jorendorff]]

This was introduced by the patch in bug 424376.

js_InitFunctionClass does this:
    proto = JS_InitClass(cx, obj, NULL, &js_FunctionClass, Function, 1,
                         function_props, function_methods, NULL, NULL);
    ...
    funobj = js_NewScriptedFunction(cx, OBJ_TO_FUNCTION(proto), 0, obj, NULL);

JS_InitClass allocates `sizeof(JSObject)` bytes for `proto`:
    proto = js_NewObject(cx, clasp, parent_proto, obj, 0);

but `OBJ_TO_FUNCTION(proto)` expects `proto` to be a JSFunction, which is a word bigger.

Comment 1

[Jason Orendorff [:jorendorff]]

False alarm!

<igor> jorendorff: js_NewObject makes sure that  JSFunction is properly allocated, see http://lxr.mozilla.org/seamonkey/source/js/src/jsobj.c#2469
<jorendorff> thanks
<jorendorff> i must not have merged that properly
<jorendorff> yep

Sorry all.