428366 - Assertion failure after deleting eval 16 times

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix

+++ This bug was initially created as a clone of Bug #416834 +++

this.__proto__.x = eval;
for (i = 0; i < 16; ++i) delete eval;
(function w() { x = 1; })();

In bug 416834, the above testcase was causing unexpected prototype chains of length 16. This is because when we resolve 'eval' in JS_ResolveStandardClass, we call js_InitObjectClass, which is not idempotent. The patch in the other bug fixes the assertion in the property cache, but not the underlying problem. I have a patch to do so.

Comment 1

[Brendan Eich [:brendan]]

Comment on attachment 314916 [details] [diff] [review]
Proposed fix

Great!

/be

Comment 2

[Brendan Eich [:brendan]]

Comment on attachment 314916 [details] [diff] [review]
Proposed fix

This is safe, it's a missing part of the change for bug 352045, so fixes a regression from Firefox 2.

/be

Comment 3

[Brian Crowder]

jsapi.c: 3.443
jsobj.c: 3.465
jsobj.h: 3.103

Comment 4

[Bob Clary [:bc] (inactive)]

(In reply to comment #0)

mrbkap: who has the prototype chain of length 16?

Comment 5

[Bob Clary [:bc] (inactive)]

added test http://hg.mozilla.org/mozilla-central/rev/1305b9b2633b and cvs.