Closed Bug 602806 Opened 9 years ago Closed 9 years ago

jsclone.h can create invalid Date objects

Categories

(Core :: JavaScript Engine, defect)

Other Branch
defect
Not set

Tracking

()

RESOLVED FIXED

People

(Reporter: jorendorff, Assigned: jorendorff)

Details

(Whiteboard: [fixed-in-tracemonkey])

Attachments

(1 file)

It's not the end of the world, but it's not good:

  js> d = new Date(Infinity);             // See ES5 §15.9.1.14, TimeClip
  (new Date(NaN))                         // result is NaN
  js> a = serialize(d)
  ({0:0, 1:0, 2:0, 3:0, 4:5, 5:0, 6:255, 7:255, 8:0, 9:0, 10:0, 11:0, 12:0,
   13:0, 14:248, 15:127})
  js> a[14] = 240
  240
  js> deserialize(a)                      // this should throw
  (new Date(Infinity))                    // rather than create this object
Attached patch v1Splinter Review
Assignee: general → jorendorff
Attachment #481781 - Flags: review?(gal)
Attachment #481781 - Flags: review?(gal) → review+
Comment on attachment 481781 [details] [diff] [review]
v1

Customary to convert macros to static inlines _en passant_ -- at least I like it when people do that ;-).

/be
http://hg.mozilla.org/tracemonkey/rev/3c1d1a61f75d
Whiteboard: [fixed-in-tracemonkey]
http://hg.mozilla.org/mozilla-central/rev/3c1d1a61f75d
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.