Closed Bug 936232 Opened 6 years ago Closed 6 years ago

js_InitTypedObjectClass is not APPLICATION_SLOTS-aware, and clobbers the DataView constructor

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set

Tracking

()

RESOLVED FIXED
mozilla28

People

(Reporter: bholley, Assigned: bholley)

References

Details

(Whiteboard: [qa-])

Attachments

(1 file)

Currently, it does:

global->setReservedSlot(JSProto_TypedObject, moduleValue);

But this breaks with the work done in bug 923836, where we added 3 slots of padding to the global for use by the embedding.

So currently, it's going to be 3 slots off, and clobber the DataView constructor.

Easy fix. We should uplift to aurora.
Blocks: 933681
js_InitTypedObjectClass doesn't run on Aurora, so uplift ought not to be necessary.
Attachment #831607 - Flags: review?(jorendorff)
Attachment #831607 - Flags: review?(jorendorff) → review+
(Green try run in bug 933681)
https://hg.mozilla.org/mozilla-central/rev/0762c5c2f533
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
Whiteboard: [qa-]
You need to log in before you can comment on or make changes to this bug.