Closed Bug 566806 Opened 14 years ago Closed 14 years ago

scripted proxy traps don't guarantee that numeric ids are JSVAL_INT

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: jruderman, Assigned: gal)

References

Details

(Keywords: assertion, testcase, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

var x = Proxy.create({
  get: function() {},
  enumerateOwn: function() { return ['0']; }
});
JSON.stringify(x);

Assertion failure: js_CheckForStringIndex(ida->vector[n]) == ida->vector[n], at ../jsapi.cpp:3845
Thread 0 Crashed:
0   JS_Assert + 93
1   JS_Enumerate + 129
2   __ZL2JOP9JSContextPlP16StringifyContext + 333
3   __ZL3StrP9JSContextlP8JSObjectP16StringifyContextPlb + 1233
4   js_Stringify + 478
5   js_json_stringify(JSContext*, unsigned int, long*) + 335
6   js_Interpret + 87318
7   js_Execute + 1247
8   JS_ExecuteScript + 54
9   __ZL7ProcessP9JSContextP8JSObjectPci + 1337
10  __ZL11ProcessArgsP9JSContextP8JSObjectPPci + 2283
11  main + 417 (js.cpp:5100)
12  _start + 209
13  start + 41
Summary: Assertion with JSON.stringify on proxy → scripted proxy traps don't guarantee that numeric id's are JSVAL_INT
Attached patch patchSplinter Review
Assignee: general → gal
Attachment #446169 - Flags: review?(brendan)
Attachment #446169 - Flags: review?(brendan) → review+
http://hg.mozilla.org/tracemonkey/rev/02522f9a67ac
Whiteboard: fixed-in-tracemonkey
Summary: scripted proxy traps don't guarantee that numeric id's are JSVAL_INT → scripted proxy traps don't guarantee that numeric ids are JSVAL_INT
Blocks: 566818
No longer blocks: 566818
http://hg.mozilla.org/mozilla-central/rev/02522f9a67ac
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: