Closed
Bug 469937
Opened 16 years ago
Closed 16 years ago
Properties without DontEnum are sometimes not enumerated
Categories
(Rhino Graveyard :: Core, defect)
Rhino Graveyard
Core
Tracking
(Not tracked)
RESOLVED
FIXED
People
(Reporter: heycam, Assigned: szegedia)
Details
Attachments
(1 file)
2.21 KB,
patch
|
Details | Diff | Splinter Review |
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2a1pre) Gecko/20081214 Minefield/3.2a1pre Build Identifier: Rhino 1.7 release 3 PRERELEASE 2008 12 17 Certain sequences of operations on an object can cause a property to be not placed in the ordered linked list of properties. Specifically this happens when: * A property p1 with slot index X is created * A property p2 with slot index Y (where X != Y) is created * Property p2 is deleted * The object's properties are enumerated * A property p3 with slot index Y is created After this, p3 is on the object, but won't be enumerated. Reproducible: Always Steps to Reproduce: Evaluate the following script: o = { } o.PageLeft = 1 o.Rect2 = 6 delete o.Rect2 for (var p in o); o.Rect3 = 7 found = false for (var p in o) if (p == 'Rect3') found = true java.lang.System.out.println("found = " + found) Actual Results: Prints out "found = false". Expected Results: Print out "found = true".
Reporter | ||
Comment 1•16 years ago
|
||
The bug is that lastAdded is not updated when the final slot of the ordered property linked list is removed due to it having wasDeleted == true. If this happens, then when a property slot is created after this, it will be assigned to lastAdded.orderedNext inside accessSlot(), resulting in it not being reached when traversing the list starting from firstAdded the next time the properties are enumerated. The patch updates getIds(boolean) to ensure lastAdded remains pointing to the last slot in the list.
Attachment #353354 -
Flags: review?
Reporter | ||
Comment 2•16 years ago
|
||
Actually, disregard the stuff about the slot indexes in the first comment, that's a red herring. The situation the bug occurs in is just: * Start with an object that has at least one property and which hasn't had its most recently added property (or properties) deleted * Create a property p1 * Delete property p1 * Enumerate the object's properties * Create property p2 (where p2 ! p1) Then p2 won't be enumerated.
Assignee | ||
Comment 3•16 years ago
|
||
Committed to CVS HEAD; also added a unit test (confirmed that it failed before the patch and it passes after the patch). cvs ci -m "Fix (and testcase) for Bug #469937 "Properties without DontEnum are sometimes not enumerated"" -l "/tests/ecma_3/Regress/regress-469937.js" RCS file: /cvsroot/mozilla/js/tests/ecma_3/Regress/regress-469937.js,v done Checking in ecma_3/Regress/regress-469937.js; /cvsroot/mozilla/js/tests/ecma_3/Regress/regress-469937.js,v <-- regress-469937.js initial revision: 1.1 done ok (took 0:11.235) *** *** cvs ci -m "Fix (and testcase) for Bug #469937 "Properties without DontEnum are sometimes not enumerated"" -l "/Rhino/src/org/mozilla/javascript/ScriptableObject.java" Checking in src/org/mozilla/javascript/ScriptableObject.java; /cvsroot/mozilla/js/rhino/src/org/mozilla/javascript/ScriptableObject.java,v <-- ScriptableObject.java new revision: 1.142; previous revision: 1.141 done ok (took 0:05.722) ***
Status: UNCONFIRMED → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
Assignee | ||
Updated•16 years ago
|
Assignee: nobody → szegedia
Comment 4•16 years ago
|
||
Fix propagated to 1.7R2 release branch
Reporter | ||
Updated•11 years ago
|
Attachment #353354 -
Flags: review?
You need to log in
before you can comment on or make changes to this bug.
Description
•