Closed Bug 633020 Opened 9 years ago Closed 9 years ago

ArgSetter can return false without reporting an error on trace

Categories

(Core :: JavaScript Engine, defect)

Other Branch
defect
Not set

Tracking

()

RESOLVED FIXED

People

(Reporter: jorendorff, Assigned: jorendorff)

Details

(Whiteboard: [fixed-in-tracemonkey])

Attachments

(1 file)

function f(b) {
    var a = [];
    for (var i = 0; i < 20; i++)
        a[i] = {};
    a[19] = arguments;
    for (var i = 0; i < 20; i++)
        a[i][0] = i;  // script terminates here
    assertEq(b, 19);  // we never get here
}
f(null);
print("PASSED");  // we never get here

Patch coming.
Attached patch v1Splinter Review
Assignee: general → jorendorff
Attachment #511219 - Flags: review?(dmandelin)
If you apply the patch, then run the test without building, you'll notice that
the jit-test test harness doesn't actually detect this situation as an error.

That is because the js executable doesn't detect this kind of internal error. It exits normally either way. I think the solution is to assert that this never happens; see bug 633033.
Attachment #511219 - Flags: review?(dmandelin) → review+
Comment on attachment 511219 [details] [diff] [review]
v1

Setting a?. This isn't a blocker but I'd like to get it in. Correctness bug.
Attachment #511219 - Flags: approval2.0?
Attachment #511219 - Flags: approval2.0? → approval2.0+
http://hg.mozilla.org/tracemonkey/rev/1a043548af6e
Whiteboard: [fixed-in-tracemonkey]
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.