Crash [@ js_ValueToString] when trying to get the the parent of a function, scoped in a function, scoped in an object

RESOLVED WORKSFORME

Status

()

Core
JavaScript Engine
RESOLVED WORKSFORME
7 years ago
7 years ago

People

(Reporter: mano, Unassigned)

Tracking

unspecified
x86
Mac OS X
Points:
---

Firefox Tracking Flags

(blocking2.0 betaN+)

Details

Attachments

(2 attachments)

Comment hidden (empty)
Created attachment 483738 [details]
testcase

This, of course, requires UniversalXPConnect.
Created attachment 483739 [details]
log
Well, not that complicated: The crash happens even if I try to get the parent of |a| in my testcase.
One more note: of course, we also crash when jsdIDebugger's jsParent is used (when calling getWrappedValue).
We crash when converting the returned value to string, not when getparent is called.  I guess this is related to the fact the returned value is exposed as an object (so says typeof), and not as a function.
blocking2.0: --- → ?

Comment 6

7 years ago
Does it crash only in UniversalXPConnect, or did you just do that to get chrome privileges?
blocking2.0: ? → betaN+
http://whereswalden.com/2010/05/07/spidermonkey-change-du-jour-the-special-__parent__-property-has-been-removed/

"Beware: this method doesn’t censor like __parent__ does! Tread cautiously when using it where a With, Call, or Block object might be exposed, and don’t use the returned object except in immediate strict equality (===) checks. (NB: we’ve implemented it this way out of expediency; if it turns out to be too great a responsibility for typical testers, we’ll likely change it to censor.)"

You are failing here because you are getting an interesting getParent() value and not being careful in how you use it.  Unless we have evidence that this failure has happened more often than just this one time, I would mark this WONTFIX.
This WFM in today's nightly.
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.