The default bug view has changed. See this FAQ.

Getting a property off an array that lives on a non-native on the proto chain and has a getter that uses |this| fails

RESOLVED FIXED in mozilla10

Status

()

Core
JavaScript Engine
P2
normal
RESOLVED FIXED
6 years ago
5 years ago

People

(Reporter: bz, Assigned: bz)

Tracking

Trunk
mozilla10
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

The problem is that we use js_NativeGet and hence have to stick to native objects.  This is a remaining unfixed case from bug 434837.  At the time we had no way to fix, but now we do.
Created attachment 571883 [details] [diff] [review]
When forwarding property gets to the proto for arrays, send along the right receiver even if the property lives on a non-native object.
Attachment #571883 - Flags: review?(jwalden+bmo)
OS: Mac OS X → All
Priority: -- → P2
Hardware: x86 → All
Whiteboard: [need review]
Version: 9 Branch → Trunk
Attachment #571883 - Flags: review?(jwalden+bmo) → review+
As I noted on IRC, this patch demonstrates one reason why we should make getOwnProperty, in some form, the fundamental property-get operation.  Every one of these methods has to hard-code the property-delegation lookup process, and every one has to be fixed if a bug is found, as here.  I started this in bug 637378 half a year ago and hit a nontrivial XBL-based snag.  Perhaps we should go back and beat XBL into submission so we could move further in that direction...
Depends on: 698495
Whiteboard: [need review] → [need landing]
https://hg.mozilla.org/integration/mozilla-inbound/rev/bdd8a7d0d45a
Flags: in-testsuite+
Whiteboard: [need landing]
Target Milestone: --- → mozilla10
https://hg.mozilla.org/mozilla-central/rev/bdd8a7d0d45a
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED

Updated

5 years ago
Depends on: 743425
You need to log in before you can comment on or make changes to this bug.