Closed
Bug 464092
Opened 16 years ago
Closed 16 years ago
"Assertion failure: OBJ_IS_CLONED_BLOCK(obj)" with string.replace, "let"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
VERIFIED
FIXED
People
(Reporter: jruderman, Assigned: mrbkap)
Details
(4 keywords)
Attachments
(1 file, 1 obsolete file)
1.03 KB,
patch
|
igor
:
review+
beltzner
:
approval1.9.1+
dveditz
:
approval1.9.0.6+
|
Details | Diff | Splinter Review |
js> let (a) 'b'.replace(/b/g, function() { c = this; }); c.d = 3; c.d; Assertion failure: OBJ_IS_CLONED_BLOCK(obj), at ../jsobj.cpp:2115 While I was trying to simplify the testcase further, I ran into this odd error message: js> let (a) 'b'.replace(/b/g, function() c = this ); typein:1: TypeError: can't convert Block to string I tried applying what I learned in bug 452913 comment 9, but wasn't able to eliminate string.replace from the testcase. Testing tracemonkey branch, but without -j.
Assignee | ||
Comment 1•16 years ago
|
||
This seems to do it -- the same way we censor access to call objects when they're used as |this|, we need to censor access to block objects.
Assignee | ||
Comment 2•16 years ago
|
||
Apparently, hg qnew -f doesn't generate the patch file until you explicitly qrefresh.
Attachment #349079 -
Attachment is obsolete: true
Attachment #349080 -
Flags: review?(igor)
Attachment #349079 -
Flags: review?(igor)
Updated•16 years ago
|
Attachment #349080 -
Flags: review?(igor) → review+
Comment 3•16 years ago
|
||
Nominating for the releases. I am not sure if the bug exists on 1.8.1, will need to check this.
Flags: blocking1.9.1?
Flags: blocking1.9.0.6?
Assignee | ||
Updated•16 years ago
|
Attachment #349080 -
Flags: approval1.9.1?
Updated•16 years ago
|
Flags: blocking1.9.1? → blocking1.9.1+
Updated•16 years ago
|
Attachment #349080 -
Flags: approval1.9.1? → approval1.9.1+
Comment 4•16 years ago
|
||
Comment on attachment 349080 [details] [diff] [review] Fix a191=beltzner
Assignee | ||
Comment 5•16 years ago
|
||
Checkin message: Bug 464092 - Censor access to block objects when they're the parents of functions. r=igor
Updated•16 years ago
|
Flags: blocking1.9.0.6? → blocking1.9.0.6+
Assignee | ||
Comment 6•16 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/1c9730e3ae64
Status: ASSIGNED → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
Comment 7•15 years ago
|
||
Blake, this still needs to land in 1.9.1, right? And does this patch apply to 1.9.0?
Whiteboard: [needs 1.9.1 checkin][needs 1.9.0 patch]
Assignee | ||
Updated•15 years ago
|
Attachment #349080 -
Flags: approval1.9.0.6?
Assignee | ||
Comment 8•15 years ago
|
||
Comment on attachment 349080 [details] [diff] [review] Fix Yeah, this applies.
Updated•15 years ago
|
Whiteboard: [needs 1.9.1 checkin][needs 1.9.0 patch] → [needs 1.9.1 checkin]
Comment 9•15 years ago
|
||
Comment on attachment 349080 [details] [diff] [review] Fix Approved for 1.9.0.6, a=dveditz for release-drivers.
Attachment #349080 -
Flags: approval1.9.0.6? → approval1.9.0.6+
Assignee | ||
Comment 11•15 years ago
|
||
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/3ac64b18de23
Keywords: fixed1.9.1
Whiteboard: [needs 1.9.1 checkin]
Comment 12•15 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/ad45bf9010b6 /cvsroot/mozilla/js/tests/js1_8/regress/regress-464092-01.js,v <-- regress-464092-01.js initial revision: 1.1 /cvsroot/mozilla/js/tests/js1_8/regress/regress-464092-02.js,v <-- regress-464092-02.js initial revision: 1.1
Flags: in-testsuite+
Comment 13•15 years ago
|
||
v 1.9.1, 1.9.2
Status: RESOLVED → VERIFIED
Keywords: fixed1.9.1 → verified1.9.1
You need to log in
before you can comment on or make changes to this bug.
Description
•