486106 - LookupResult from jsapi.cpp does not support fast arrays

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Igor Bukanov]

LookupResult, http://hg.mozilla.org/tracemonkey/file/d16703358efc/js/src/jsapi.cpp#l3224 , contains the following code:

    if (OBJ_IS_NATIVE(obj2)) {
        /* Peek at the native property's slot value, without doing a Get. */
        sprop = (JSScopeProperty *)prop;
        rval = SPROP_HAS_VALID_SLOT(sprop, OBJ_SCOPE(obj2))
               ? LOCKED_OBJ_GET_SLOT(obj2, sprop->slot)
               : JSVAL_TRUE;
    } else {
        /* XXX bad API: no way to return "defined but value unknown" */
        rval = JSVAL_TRUE;
    }
 
Due to this OBJ_IS_NATIVE(obj2) check the code ignores fast arrays. It means hat any JS API that uses this helper function would return JS_TRUE instead of the real element in the array.

I nominate this for 1.9.0 so the fix could be included in JS1.8 release.

The bug was reported in http://groups.google.com/group/mozilla.dev.tech.js-engine/msg/1cbef3c6613572d1 .

Comment 1

[Igor Bukanov]

Attachment: v1

The patch makes sure that from the point of various JS*Lookup API a fast array behaves as an ordinary native object to restore API compatibility.

Comment 2

[Mike Shaver (:shaver emeritus)]

Comment on attachment 370221 [details] [diff] [review]
v1

>+/*
>+ * Utility to access the value from the id returned by array_lookupProperty.
>+ */
>+jsval
>+js_GetDenseArrayPropertyValue(JSObject *obj, JSProperty *prop);

Wants to be called "ElementValue" I think, since it only works on int-indexed properties.  Looks good otherwise.

Comment 3

[Igor Bukanov]

I removed 1.9.0 nomination as patches for JS1.8 would go to a separated branch.

Comment 4

[Igor Bukanov]

Attachment: v2

I the new version of the patch I renamed js_GetDenseArrayPropertyValue to js_GetDenseArrayElementValue.

Comment 5

[Igor Bukanov]

landed to TM - http://hg.mozilla.org/tracemonkey/rev/51374b541888

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/51374b541888

Comment 7

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/80d7c4aac470