53037 - Call object not censored for Array.prototype.sort comparison function

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Brendan Eich [:brendan]]

Thanks to [e-mail] for finding this.

var a = [2,1];
function C(m) { this.m=m; this.cmp=function (a,b) {print(this);return a-b}}
var c = new C;
a.sort(c.cmp);

prints [object Call] twice.  It should print [object global], I believe (ECMA 
buddies, double-check me please).

/be

Comment 1

[rogerl (gone)]

The spec. doesn't say how the compare function is called other than 'call 
comparefn'. I think the implication would have to be that there was an implicit 
NULL this, hence the global object as you say. The call object doesn't seem 
useful in any case.

Comment 2

[Brendan Eich [:brendan]]

The spec does say that activation objects should never be exposed.  I think the
patch is a virtual "one-liner".  See next attachment, someone give me an r= so
we can get this in for js1.5 and ECMA purity of essence.

/be

Comment 3

[Brendan Eich [:brendan]]

Attachment: proposed fix

Comment 4

[rogerl (gone)]

Why was there a check for GetPrivate on thisp?

Comment 5

[Brendan Eich [:brendan]]

Norris wrote that code, and IIRC he was trying to hide only those Call objects
representing active JSStackFrames (which are LIFO allocated and which are the
private data of their Call object, if they represent heavyweight function calls,
only while active).  But I think ECMA mandates activation censoring everywhere.

/be

Comment 6

[Brendan Eich [:brendan]]

r=, anyone?

/be

Comment 7

[rogerl (gone)]

ok, i'll buy that
r=rogerl

Comment 8

[Brendan Eich [:brendan]]

Fix was checked in on 9/18, but I forgot to close this one.  Thanks to 
pschwartau for reminding me.

/be