Closed
Bug 980962
Opened 10 years ago
Closed 10 years ago
Fix in-tree consumers that call typed array constructors without "new"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla31
People
(Reporter: bzbarsky, Assigned: bzbarsky)
References
Details
Attachments
(1 file)
52.73 KB,
patch
|
jorendorff
:
review+
|
Details | Diff | Splinter Review |
See bug 980945.
Assignee | ||
Comment 1•10 years ago
|
||
Attachment #8387725 -
Flags: review?(jorendorff)
Assignee | ||
Updated•10 years ago
|
Assignee: nobody → bzbarsky
Status: NEW → ASSIGNED
Assignee | ||
Updated•10 years ago
|
Whiteboard: [need review]
Updated•10 years ago
|
Attachment #8387725 -
Flags: review?(jorendorff) → review+
Assignee | ||
Comment 2•10 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/ebb5b2711a9b
Flags: in-testsuite-
Whiteboard: [need review]
Blocks: 986346
Comment 3•10 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/ebb5b2711a9b
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla31
Comment 4•10 years ago
|
||
Commit pushed to master at https://github.com/mozilla/addon-sdk https://github.com/mozilla/addon-sdk/commit/6a6317549f3e1dc76a2a41d335cf5d7bbb714e4b Bug 980962. Fix in-tree consumers to not construct typed arrays without "new". r=jorendorff
Comment 5•10 years ago
|
||
Comment on attachment 8387725 [details] [diff] [review] Fix in-tree consumers to not construct typed arrays without "new". Review of attachment 8387725 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/tests/js1_8_5/extensions/clone-transferables.js @@ +9,5 @@ > for (var size of [0, 8, 16, 200, 1000, 4096, -8, -200, -8192, -65536]) { > var buffer_ctor = (size < 0) ? AsmJSArrayBuffer : ArrayBuffer; > size = Math.abs(size); > > + var old = new buffer_ctor(size); This broke this test when run in the JS shell. See three lines up where AsmJSArrayBuffer could be used here? That function (in the sibling shell.js file) depends on its |this| being the global object. Fixed now: https://hg.mozilla.org/integration/mozilla-inbound/rev/f750d0c3b58b Unfortunately, this test is skipped when not run in the JS shell, so this didn't show up on Tinderbox. :-(
Assignee | ||
Comment 6•10 years ago
|
||
Thanks for catching that!
Comment 7•10 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/f750d0c3b58b
You need to log in
before you can comment on or make changes to this bug.
Description
•