Closed Bug 509843 Opened 15 years ago Closed 15 years ago

Object initializers can call setters

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
Other Branch
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: jorendorff, Assigned: jorendorff)

References

Details

(Whiteboard: fixed-in-tracemonkey) 

Object.prototype.__defineSetter__(1, function () { throw "fit"; });
for (var i =0; i<9; i++)
    ({1:'a'});

uncaught exception: fit

The imacro for INITELEM uses SetElement. I don't know what we were thinking. I'll take this one.
I should have added a trace test for this when fixing bug 474501; back then, of course, we'd abort when we found the setter and never even come close to calling anything.
We deep-abort in this case now, actually, but it's too late, we're already in jstracer.cpp:SetElement misbehaving.
Depends on: 508051
Fixed by bug 508051, specifically:

http://hg.mozilla.org/tracemonkey/rev/d1171f8cc234

js/src/trace-test/tests/basic/testInitelemWithSetter.js is the test case in comment 0.
Whiteboard: fixed-in-tracemonkey
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.