547483 - calculating 'this' fails if the object has no parent

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Andreas Gal :gal]

(gdb) bt
#0  0x00000001039a820c in JSObject::getParent (this=0x0) at jsobj.h:293
#1  0x0000000103918932 in js_ComputeGlobalThis (cx=0x10492da00, lazy=0, argv=0x104bfc840) at jsinterp.cpp:942
#2  0x0000000103918ae9 in js_ComputeThis (cx=0x10492da00, lazy=0, argv=0x104bfc840) at jsinterp.cpp:974
#3  0x000000010391a8ee in js_Invoke (cx=0x10492da00, argc=0, vp=0x104bfc830, flags=0) at jsinterp.cpp:1217
#4  0x0000000103905ff0 in js_Interpret (cx=0x10492da00) at jsops.cpp:2303
#5  0x000000010391a05a in js_Execute () at jsinterp.cpp:1665

(this is a XOW here, window)

Comment 1

[Andreas Gal :gal]

Attachment: patch

Comment 2

[Brendan Eich [:brendan]]

Comment on attachment 427981 [details] [diff] [review]
patch

>diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
>--- a/js/src/jsinterp.cpp
>+++ b/js/src/jsinterp.cpp
>@@ -931,21 +931,23 @@ js_ComputeGlobalThis(JSContext *cx, JSBo
>         if (lazy) {
>             fp->down = cx->fp;
>             cx->fp = fp;
>             cx->popGCReachableFrame();
>         }
>         if (!ok)
>             return NULL;
> 
>-        thisp = JSVAL_IS_VOID(v)
>+        if (v != JSVAL_NULL) {

Probably want !JSVAL_IS_PRIMITIVE(v).

>+            thisp = JSVAL_IS_VOID(v)
>                 ? OBJ_GET_PARENT(cx, thisp)
>                 : JSVAL_TO_OBJECT(v);

Indent these to match.

r=me with these changes if they work, pending mrbkap better r+.

Really need to get rid of thisObject...

/be

Comment 3

[Andreas Gal :gal]

!JSVAL_IS_PRIMITIVE doesn't make sense. There is a JSVAL_IS_VOID(v) inside the condition.

Comment 4

[Andreas Gal :gal]

Attachment: patch

Comment 5

[Andreas Gal :gal]

http://hg.mozilla.org/tracemonkey/rev/2e5e3ae20ddc

Comment 6

[Brendan Eich [:brendan]]

(In reply to comment #3)
> !JSVAL_IS_PRIMITIVE doesn't make sense. There is a JSVAL_IS_VOID(v) inside the
> condition.

Oops, you're right.

What was v in the bad case?

/be

Comment 7

[Andreas Gal :gal]

null

Comment 8

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/2e5e3ae20ddc