"ParallelArray.prototype.length" causes an uncatchable exception

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: Jesse Ruderman, Unassigned)

Tracking

(Blocks: 1 bug, {testcase})

Trunk
x86_64
Mac OS X
testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment, 1 obsolete attachment)

(Reporter)

Description

5 years ago
try { ParallelArray.prototype.length; } catch(e) { } print("PASS");

Does not print "PASS".  Execution just silently halts, and the shell returns exit code 3.

This only happens on the ionmonkey branch, because bug 711304 was only pushed to the ionmonkey branch.
(Reporter)

Comment 1

5 years ago
I've disabled testing ParallelArray in jsfunfuzz for now.
Created attachment 624575 [details] [diff] [review]
makes ParallelArray.prototype.length return 0

The handler for 'length' now returns 0 if it is invoked on the prototype of ParallelArray and the actual length of the array if it is invoked on a ParallelArray object.
Attachment #624575 - Flags: review?(jorendorff)
Comment on attachment 624575 [details] [diff] [review]
makes ParallelArray.prototype.length return 0

Review of attachment 624575 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/builtin/ParallelArray.cpp
@@ +625,5 @@
> +        vp->setNumber((uint32_t) 0);
> +    } else if (obj->getClass() == &ParallelArrayClass) {
> +        /* return the length of the ParallelArray object */
> +        vp->setNumber(GetLength(obj));
> +    }

Please use
    vp->setInt32(0);
instead of vp->setNumber((uint32_t) 0).

And how about:

    if (obj->getClass() == &ParallelArrayClass) {
        ...
    } else {
        /* ... */
        JS_ASSERT(obj->getClass() == &ParallelArrayProtoClass);
        vp->setInt32(0);
    }

It's just more defensive code, in case something ever goes wrong. Which it can't.

r=me with the setInt change; the other one is optional.
Attachment #624575 - Flags: review?(jorendorff) → review+
Created attachment 624589 [details] [diff] [review]
makes ParallelArray.prototype.length return 0

Incorporates jorendorff's requests, including his more defensive approach.
Attachment #624575 - Attachment is obsolete: true
Attachment #624589 - Flags: checkin?(dvander)
http://hg.mozilla.org/projects/ionmonkey/rev/14735b4dbccc
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Attachment #624589 - Flags: checkin?(dvander)
You need to log in before you can comment on or make changes to this bug.