711638 - Uninitialized memory use in DefineGetterOrSetter

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Comment 1

[Jesse Ruderman]

Attachment: valgrind complaint

Comment 2

[Boris Zbarsky [:bzbarsky]]

The call to JS_GetPropertyAttrsGetterAndSetterById sets |found| to false.  Should we not be checking for that before examining attrs, getter, and setter?

Comment 3

[Boris Zbarsky [:bzbarsky]]

On the other hand, JS_LookupPropertyWithFlagsById claimed to find it on obj2.  Is that disagreement ok, or a bug in one or the other?

Comment 4

[Jeff Walden [:Waldo]]

I think this is the double-lookup problem that the new direct proxies spec thingamabob is supposed to help resolve.

What happens now is you have a property lookup, which can trigger a proxy operation that says the property exists.  Then you have the property get, which can trigger a second lookup or what-have-you that says it doesn't.  The "old" proxies spec we implement has no story there, so there is no sane story here.

Again, the claim I've heard is the direct proxies thing gets rid of the double lookup to eliminate the possibility of contradiction.  I haven't investigated it yet.  Maybe I should so I at least know what's up there.  And maybe it's worth just implementing it, seeing as the proxy ops need index/name/special splitting now anyway, which mess might be simpler under direct proxies.  (Or might not.)  Unfortunately that kind of delays split-storage even longer, possibly...

Comment 5

[Jeff Walden [:Waldo]]

Direct proxies are bug 703537.

Comment 6

[BMO Automation]

Per policy at https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Inactive_Bugs. If this bug is not an enhancement request or a bug not present in a supported release of Firefox, then it may be reopened.

Comment 7

[Boris Zbarsky [:bzbarsky]]

DefineGetterOrSetter is long gone, along with quickstubs.