Closed Bug 624050 Opened 13 years ago Closed 13 years ago

Crash when defining setter inside a watch

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
Tracking Status
blocking2.0 --- final+
status1.9.2 --- unaffected
status1.9.1 --- unaffected

People

(Reporter: dvander, Assigned: dvander)

Details

(Whiteboard: [ccbr][sg:critical][hardblocker][fixed-in-tracemonkey])

Attachments

(1 file)

o = { }
o.watch("x", function (prop, oldval, newval) { return x(prop, oldval, newval); })
x = function (prop, oldval, newval) {
    Object.defineProperty(o, prop, { set: function () { print("HI!"); } });
}
o.x = 2

Crashes trying to execute a JSFunction as a JSPropertyOp in js_watch_set.
blocking2.0: --- → final+
Whiteboard: [ccbr][sg:critical][hardblocker]
This reminds me of a bug jimb had, I think.

/be
(In reply to comment #1)
> This reminds me of a bug jimb had, I think.

"had" as in "took on" -- maybe a different bug but seemed good to cc: Jim for watchpoint expertise.

/be
Attached patch fixSplinter Review
Attachment #502133 - Flags: review?(jimb)
Attachment #502133 - Flags: review?(jimb) → review+
http://hg.mozilla.org/tracemonkey/rev/96203bfc94f2
Whiteboard: [ccbr][sg:critical][hardblocker] → [ccbr][sg:critical][hardblocker][fixed-in-tracemonkey]
http://hg.mozilla.org/mozilla-central/rev/96203bfc94f2
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Group: core-security
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: