Closed
Bug 624050
Opened 13 years ago
Closed 13 years ago
Crash when defining setter inside a watch
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
Tracking | Status | |
---|---|---|
blocking2.0 | --- | final+ |
status1.9.2 | --- | unaffected |
status1.9.1 | --- | unaffected |
People
(Reporter: dvander, Assigned: dvander)
Details
(Whiteboard: [ccbr][sg:critical][hardblocker][fixed-in-tracemonkey])
Attachments
(1 file)
1014 bytes,
patch
|
jimb
:
review+
|
Details | Diff | Splinter Review |
o = { } o.watch("x", function (prop, oldval, newval) { return x(prop, oldval, newval); }) x = function (prop, oldval, newval) { Object.defineProperty(o, prop, { set: function () { print("HI!"); } }); } o.x = 2 Crashes trying to execute a JSFunction as a JSPropertyOp in js_watch_set.
Assignee | ||
Updated•13 years ago
|
blocking2.0: --- → final+
Whiteboard: [ccbr][sg:critical][hardblocker]
Comment 1•13 years ago
|
||
This reminds me of a bug jimb had, I think. /be
Assignee | ||
Updated•13 years ago
|
status1.9.1:
--- → unaffected
status1.9.2:
--- → unaffected
Comment 2•13 years ago
|
||
(In reply to comment #1) > This reminds me of a bug jimb had, I think. "had" as in "took on" -- maybe a different bug but seemed good to cc: Jim for watchpoint expertise. /be
Assignee | ||
Comment 3•13 years ago
|
||
Attachment #502133 -
Flags: review?(jimb)
Updated•13 years ago
|
Attachment #502133 -
Flags: review?(jimb) → review+
Assignee | ||
Comment 4•13 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/96203bfc94f2
Whiteboard: [ccbr][sg:critical][hardblocker] → [ccbr][sg:critical][hardblocker][fixed-in-tracemonkey]
Comment 5•13 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/96203bfc94f2
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Updated•9 years ago
|
Group: core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•