496213 - creating aliases in user-defined toSource breaks sharp objects

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Luke Wagner [:luke]]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.10) Gecko/2009042523 Ubuntu/9.04 (jaunty) Firefox/3.0.10
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.10) Gecko/2009042523 Ubuntu/9.04 (jaunty) Firefox/3.0.10

As explained on line 521 in jsobj.cpp (mozilla-central 6/3), after the initial mark phase of js_EnterSharpObject, there can be changes to properties.  This is partially handled by line 528 adding new objects to the sharp map, but it doesn't correctly handle the possibility that the object may require a sharp.

Example 1:
var single = { single:1 };
var tricky1 = { toSource:function(){a[2]=single;return "tricky"} };
var a = [tricky1,single,0];
print("\'single\' duplicated: " + a.toSource());
print("OK after first time: " + a.toSource());

Example 2:
var tricky2 = { toSource:function(){a[1]=single;a[2]=single;return "tricky"} };
a = [tricky2,0,0];
print("\'single\' duplicated: " + a.toSource());
print("OK after first time: " + a.toSource());

Notice that, in the first one, the Mark procedure fails to indicate that a[1] should be prefixed with #1= by the time a[1] is written to the buffer.

Reproducible: Always

Steps to Reproduce:
Examples above attached.

Comment 1

[Luke Wagner [:luke]]

Attachment: Runnable script of the two examples in bug description