js_InitFunctionClass doesn't make Function.prototype a JSFunction

RESOLVED INVALID

Status

()

Core
JavaScript Engine
RESOLVED INVALID
10 years ago
10 years ago

People

(Reporter: jorendorff, Unassigned)

Tracking

Other Branch
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

10 years ago
This was introduced by the patch in bug 424376.

js_InitFunctionClass does this:
    proto = JS_InitClass(cx, obj, NULL, &js_FunctionClass, Function, 1,
                         function_props, function_methods, NULL, NULL);
    ...
    funobj = js_NewScriptedFunction(cx, OBJ_TO_FUNCTION(proto), 0, obj, NULL);

JS_InitClass allocates `sizeof(JSObject)` bytes for `proto`:
    proto = js_NewObject(cx, clasp, parent_proto, obj, 0);

but `OBJ_TO_FUNCTION(proto)` expects `proto` to be a JSFunction, which is a word bigger.
(Reporter)

Comment 1

10 years ago
False alarm!

<igor> jorendorff: js_NewObject makes sure that  JSFunction is properly allocated, see http://lxr.mozilla.org/seamonkey/source/js/src/jsobj.c#2469
<jorendorff> thanks
<jorendorff> i must not have merged that properly
<jorendorff> yep

Sorry all.
Status: NEW → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.