Last Comment Bug 743480 - "ParallelArray.prototype.length" causes an uncatchable exception
: "ParallelArray.prototype.length" causes an uncatchable exception
Status: RESOLVED FIXED
: testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Mac OS X
: -- normal (vote)
: ---
Assigned To: general
:
:
Mentors:
Depends on:
Blocks: jsfunfuzz 711304
  Show dependency treegraph
 
Reported: 2012-04-07 15:30 PDT by Jesse Ruderman
Modified: 2012-05-17 11:04 PDT (History)
6 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
makes ParallelArray.prototype.length return 0 (1.35 KB, patch)
2012-05-16 16:02 PDT, Stephan Herhut [:masterofhats]
jorendorff: review+
Details | Diff | Splinter Review
makes ParallelArray.prototype.length return 0 (1.35 KB, patch)
2012-05-16 16:25 PDT, Stephan Herhut [:masterofhats]
no flags Details | Diff | Splinter Review

Description Jesse Ruderman 2012-04-07 15:30:59 PDT
try { ParallelArray.prototype.length; } catch(e) { } print("PASS");

Does not print "PASS".  Execution just silently halts, and the shell returns exit code 3.

This only happens on the ionmonkey branch, because bug 711304 was only pushed to the ionmonkey branch.
Comment 1 Jesse Ruderman 2012-04-07 15:37:12 PDT
I've disabled testing ParallelArray in jsfunfuzz for now.
Comment 2 Stephan Herhut [:masterofhats] 2012-05-16 16:02:04 PDT
Created attachment 624575 [details] [diff] [review]
makes ParallelArray.prototype.length return 0

The handler for 'length' now returns 0 if it is invoked on the prototype of ParallelArray and the actual length of the array if it is invoked on a ParallelArray object.
Comment 3 Jason Orendorff [:jorendorff] 2012-05-16 16:09:19 PDT
Comment on attachment 624575 [details] [diff] [review]
makes ParallelArray.prototype.length return 0

Review of attachment 624575 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/builtin/ParallelArray.cpp
@@ +625,5 @@
> +        vp->setNumber((uint32_t) 0);
> +    } else if (obj->getClass() == &ParallelArrayClass) {
> +        /* return the length of the ParallelArray object */
> +        vp->setNumber(GetLength(obj));
> +    }

Please use
    vp->setInt32(0);
instead of vp->setNumber((uint32_t) 0).

And how about:

    if (obj->getClass() == &ParallelArrayClass) {
        ...
    } else {
        /* ... */
        JS_ASSERT(obj->getClass() == &ParallelArrayProtoClass);
        vp->setInt32(0);
    }

It's just more defensive code, in case something ever goes wrong. Which it can't.

r=me with the setInt change; the other one is optional.
Comment 4 Stephan Herhut [:masterofhats] 2012-05-16 16:25:30 PDT
Created attachment 624589 [details] [diff] [review]
makes ParallelArray.prototype.length return 0

Incorporates jorendorff's requests, including his more defensive approach.
Comment 5 David Anderson [:dvander] 2012-05-17 11:04:29 PDT
http://hg.mozilla.org/projects/ionmonkey/rev/14735b4dbccc

Note You need to log in before you can comment on or make changes to this bug.