709067 - JS Correctness: Another issue with/without TI and defineProperty/prototype

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test produces different output with options "-m -a" vs. "-m -a -n" on mozilla-central revision 63bff373cb94:


Object.defineProperty(Object.prototype, 0, {set: function() { this.abstract; }});
function testStringify() {
    var t = true;
    var a = [];
    a[0] = "" + t;
    return a.join(",");
}
print(testStringify());


Output:
$ $JS -m -a min.js

$ $JS -m -a -n min.js
true


The test looks like bug 706808 but that is fixed already.

Comment 1

[Brian Hackett [Laid off!]]

Attachment: patch

Similar issue to bug 706808, but affecting indexed array properties --- setters were only getting called when directly on Array.prototype, and non-writable prototype properties were getting ignored entirely.

Comment 2

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/35d59a6e829d

Comment 3

[David Mandelin [:dmandelin]]

Brian, do you think we should nominate this for 10?

Comment 4

[Brian Hackett [Laid off!]]

Comment on attachment 580459 [details] [diff] [review]
patch

Sure.

Comment 5

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/35d59a6e829d

Comment 6

[Alex Keybl [:akeybl]]

(In reply to Brian Hackett (:bhackett) from comment #4)
> Comment on attachment 580459 [details] [diff] [review]
> patch
> 
> Sure.

[Triage Comment]
Can you help us understand the risk involved with this patch? Thanks!

Comment 7

[Brian Hackett [Laid off!]]

The problem here is similar to bug 706808, with a similar (small) risk.

Comment 8

[LegNeato]

Comment on attachment 580459 [details] [diff] [review]
patch

Approved for mozilla-aurora. Please land today.

Comment 9

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/2bd5ab8de0f0

Comment 10

[Mihaela Velimiroviciu (:mihaelav)]

Ubuntu 11.04 64 bit

I built Spidermonkey for the latest beta (rev d46a4577a631) and run the test from comment #0: same output is produced in both cases (-m -a -n and -m -a):
./js -m -a -n test709067 


./js -m -a test709067 


Marking verified for Firefox 11.