Closed
Bug 565202
Opened 14 years ago
Closed 14 years ago
JM: JaegerShot doesn't set cx->resolveFlags
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: dmandelin, Assigned: dmandelin)
References
Details
Attachments
(1 file)
|
954 bytes,
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
A 'permission denied' that doesn't happen if the method jit is off.
|
Assignee | |
Comment 1•14 years ago
|
||
Cause of the bug: cx->resolveFlags wasn't getting set to JSRESOLVE_INFER. The security checks use the resolve flags to see what kind of access it is. In this case, setting document.location.hash is allowed for anyone, but getting it is not. Without the inferred flags, the access looks like a get, so access is denied.
Summary: JM: JS error on tests/content/base/test/test_bug326337.html → JM: JaegerShot doesn't set cx->resolveFlags
|
|
Assignee | |
Comment 2•14 years ago
|
||
Attachment #445154 -
Flags: review?(dvander)
|
||
Updated•14 years ago
|
Attachment #445154 -
Flags: review?(dvander) → review+
|
|
Assignee | |
Comment 3•14 years ago
|
||
http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/file/abce0335ed56
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
|
|
Assignee | |
Comment 4•14 years ago
|
||
Followup patch: http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/file/44603cbccade
|
||
Comment 5•14 years ago
|
||
FWIW, the .../jaegermonkey/rev/... URLs are much friendlier for some of us newbies reading through these bugs :)
You need to log in
before you can comment on or make changes to this bug.
Description
•