Closed Bug 504227 Opened 16 years ago Closed 14 years ago

Strings in reserved slots are not made immutable when objects become MT

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
Other Branch
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED INVALID

People

(Reporter: jorendorff, Unassigned)

Details

FinishSharingTitle only calls js_MakeStringImmutable() for strings referenced by the slots of TITLE_TO_SCOPE(title)->object. But that scope could be shared by many objects. Of those objects, only TITLE_TO_SCOPE(title)->object can have any own properties; but the other objects may have reserved slots that point to strings.
This could be fixed by moving to a scheme where individual objects, not scopes, are locked.
(In reply to comment #1) > This could be fixed by moving to a scheme where individual objects, not scopes, > are locked. Per bug 408416 that is the right direction. Use this bug for that, make it block bug 408416 ? Or new bug that blocks bug 408416 and have this bug depend on the new bug, if that makes sense for some reason. /be
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.