936232 - js_InitTypedObjectClass is not APPLICATION_SLOTS-aware, and clobbers the DataView constructor

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Bobby Holley (:bholley)]

Currently, it does:

global->setReservedSlot(JSProto_TypedObject, moduleValue);

But this breaks with the work done in bug 923836, where we added 3 slots of padding to the global for use by the embedding.

So currently, it's going to be 3 slots off, and clobber the DataView constructor.

Easy fix. We should uplift to aurora.

Comment 1

[Niko Matsakis [:nmatsakis]]

js_InitTypedObjectClass doesn't run on Aurora, so uplift ought not to be necessary.

Comment 2

[Bobby Holley (:bholley)]

Attachment: Use setConstructor for TypedObject. v1

Comment 3

[Bobby Holley (:bholley)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0762c5c2f533

Comment 4

[Bobby Holley (:bholley)]

(Green try run in bug 933681)

Comment 5

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/0762c5c2f533