509843 - Object initializers can call setters

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jason Orendorff [:jorendorff]]

Object.prototype.__defineSetter__(1, function () { throw "fit"; });
for (var i =0; i<9; i++)
    ({1:'a'});

uncaught exception: fit

The imacro for INITELEM uses SetElement. I don't know what we were thinking. I'll take this one.

Comment 1

[Jeff Walden [:Waldo]]

I should have added a trace test for this when fixing bug 474501; back then, of course, we'd abort when we found the setter and never even come close to calling anything.

Comment 2

[Jason Orendorff [:jorendorff]]

We deep-abort in this case now, actually, but it's too late, we're already in jstracer.cpp:SetElement misbehaving.

Comment 3

[Jason Orendorff [:jorendorff]]

Fixed by bug 508051, specifically:

http://hg.mozilla.org/tracemonkey/rev/d1171f8cc234

js/src/trace-test/tests/basic/testInitelemWithSetter.js is the test case in comment 0.