uint property lookup on missing property on sealed object does not throw exception if uint value has not been interned

NEW
Unassigned

Status

P3
normal
8 years ago
7 years ago

People

(Reporter: lhansen, Unassigned)

Tracking

unspecified
Q1 12 - Brannan
Bug Flags:
flashplayer-injection -
flashplayer-qrb +
flashplayer-bug -
flashplayer-needsversioning +

Details

(Reporter)

Description

8 years ago
Test cases, note the objects are all sealed:

This throws an error as it should:

  class A {}
  print((new A)["foo"]);

This does not throw an error (it prints undefined), though it should have:

  class A {}
  print((new A)[33]);

This throws an error on the first print line:

  class A {}
  print((new A)[32]);
  print((new A)["32"])

This throws an error on the second print line (after printing undefined), though it should have thrown it on the first:

  class A {}
  print((new A)[33]);
  print((new A)["32"])

In all cases the problem appears to be a case in ScriptObject::getUintProperty that checks for whether the integer value has been interned; if it is, getAtomProperty is called on the interned value, otherwise undefined is returned (on the assumption the property is not there).  But if the object is sealed an exception should have been thrown at that point.
Flags: flashplayer-needsversioning+
(Reporter)

Comment 1

8 years ago
Jeff notes that interpreter and jit behavior are the same.

Updated

7 years ago
Flags: flashplayer-qrb+
Flags: flashplayer-injection-
Flags: flashplayer-bug-
Target Milestone: Q3 11 - Serrano → Q1 12 - Brannan
You need to log in before you can comment on or make changes to this bug.