588041 - ToXMLList from XML object does not correctly set XMLListObject::m_targetObject

Status: RESOLVED FIXED

(Tamarin Graveyard :: Virtual Machine, defect)

Description

[Werner Sharp]

player bug #2676112.

The following code:

var listOrig:XMLList = <><item>1</item></>;
var listCopy:XMLList = <></>;
listCopy += XMLList(listOrig[0]);
listCopy[0] += <item>2</item>;

...calls XMLListClass::ToXMLList with an XML object and then calls the XMLListObject constructor with an undefined parent atom.  Later on, we get into XMLListObject::setUintProperty step 2a with a non-null m_targetProperty that does not equal either a XML or XMLList object.  This causes the setUintProperty to fail.

This is a fallout of our append XML optimizations for last release.  Previously, our append operation would clear the undefinedAtom value and force it to nullObjectAtom.

Comment 1

[Werner Sharp]

Attachment: if parent is undefinedatom, pass in nullObjectAtom

Comment 2

[Werner Sharp]

Attachment: testcase

Comment 3

[Werner Sharp]

Attachment: testcase

Comment 4

[Werner Sharp]

http://hg.mozilla.org/tamarin-redux/rev/0410656e263d