Patch for bug 465241 introduces buggy js_Int32ToId

VERIFIED FIXED in mozilla1.9.1b2

Status

()

Core
JavaScript Engine
P1
critical
VERIFIED FIXED
10 years ago
10 years ago

People

(Reporter: brendan, Assigned: brendan)

Tracking

({testcase, verified1.9.1})

Trunk
mozilla1.9.1b2
testcase, verified1.9.1
Points:
---
Bug Flags:
blocking1.9.1 +
in-testsuite +
in-litmus -

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

10 years ago
See bug 465241 comment 6. a[-1] is not the same as a[0xffffffff] for an array or any JS object.

/be
(Assignee)

Comment 1

10 years ago
Thinking we need to get this right ASAP...

/be
Flags: blocking1.9.1?
Priority: -- → P1
(Assignee)

Comment 2

10 years ago
Created attachment 348563 [details] [diff] [review]
minimal fix

No need to fuss with js_Any_[gs]etprop to optimize "42" to 42, that will happen at a lower level (jsobj.cpp, jsarray.cpp) if need be.

Safe fix for b2, recommend we take it.

/be
Attachment #348563 - Flags: review?(gal)
(Assignee)

Updated

10 years ago
Attachment #348563 - Flags: approval1.9.1b2?

Comment 3

10 years ago
Comment on attachment 348563 [details] [diff] [review]
minimal fix

Pushed to TM.

http://hg.mozilla.org/tracemonkey/rev/d931c1b8d0e7
Attachment #348563 - Flags: review?(gal) → review+

Updated

10 years ago
Status: ASSIGNED → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED
reopening, marking blocking beta2, will close once landed on m-c.
Status: RESOLVED → REOPENED
Flags: blocking1.9.1? → blocking1.9.1+
Resolution: FIXED → ---
Attachment #348563 - Flags: approval1.9.1b2? → approval1.9.1b2+
Comment on attachment 348563 [details] [diff] [review]
minimal fix

a1.9.1b2=beltzner for good measure, redundancy
(Assignee)

Comment 6

10 years ago
This was never in m-c, so it could be closed now. Just hoping we sync tm and m-c since I think nothing unwanted has gone in and we don't want to miss anything.

/be
Fixed in the merge pushed by vlad on Nov 18 14:11:14 2008 -0800:
http://hg.mozilla.org/mozilla-central/rev/e8ed5d4bf531
Status: REOPENED → RESOLVED
Last Resolved: 10 years ago10 years ago
Resolution: --- → FIXED
Checking in js1_5/Regress/regress-465347.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-465347.js,v  <--  regress-465347.js
initial revision: 1.1
done
Flags: in-testsuite+
Flags: in-litmus-
Keywords: fixed1.9.1
v 1.9.1, 1.9.2
Status: RESOLVED → VERIFIED
Keywords: fixed1.9.1 → testcase, verified1.9.1
You need to log in before you can comment on or make changes to this bug.