Bug 617405 - Assertion failure: isObject() after defining getter on .prototype property of constructor. Take 2, removes two wrong tests. r=Waldo. (Additional r=Waldo on IRC to remove the tests.)
authorJason Orendorff <jorendorff@mozilla.com>
Wed, 08 Dec 2010 17:01:42 -0600
changeset 59002 8220ab3cbe995be4de5e8e213914669101a1f609
parent 59001 aa1d2555b057e425605094e065501b678a09c84c
child 59003 929ed9d5d81b97a1ac8693ad2b2625fcfe9a996d
push id1
push usershaver@mozilla.com
push dateTue, 04 Jan 2011 17:58:04 +0000
reviewersWaldo, Waldo
bugs617405
milestone2.0b8pre
Bug 617405 - Assertion failure: isObject() after defining getter on .prototype property of constructor. Take 2, removes two wrong tests. r=Waldo. (Additional r=Waldo on IRC to remove the tests.)
js/src/jsfun.cpp
js/src/jsinterpinlines.h
js/src/tests/js1_5/extensions/jstests.list
js/src/tests/js1_5/extensions/regress-313500.js
js/src/tests/js1_5/extensions/regress-325269.js
js/src/tests/js1_8_5/regress/jstests.list
js/src/tests/js1_8_5/regress/regress-617405-1.js
js/src/tests/js1_8_5/regress/regress-617405-2.js
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -1695,20 +1695,16 @@ fun_resolve(JSContext *cx, JSObject *obj
         /*
          * Assert that fun is not a compiler-created function object, which
          * must never leak to script or embedding code and then be mutated.
          * Also assert that obj is not bound, per the ES5 15.3.4.5 ref above.
          */
         JS_ASSERT(!IsInternalFunctionObject(obj));
         JS_ASSERT(!obj->isBoundFunction());
 
-        /* No need to reflect fun.prototype in 'fun.prototype = ... '. */
-        if (flags & JSRESOLVE_ASSIGNING)
-            return true;
-
         /*
          * Make the prototype object an instance of Object with the same parent
          * as the function object itself.
          */
         JSObject *parent = obj->getParent();
         JSObject *proto;
         if (!js_GetClassPrototype(cx, parent, JSProto_Object, &proto))
             return false;
--- a/js/src/jsinterpinlines.h
+++ b/js/src/jsinterpinlines.h
@@ -726,17 +726,17 @@ ScriptEpilogue(JSContext *cx, JSStackFra
      */
     if (fp->isFunctionFrame() && !fp->isEvalFrame() && !fp->isYielding())
         PutActivationObjects(cx, fp);
 
     /*
      * If inline-constructing, replace primitive rval with the new object
      * passed in via |this|, and instrument this constructor invocation.
      */
-    if (fp->isConstructing()) {
+    if (fp->isConstructing() && ok) {
         if (fp->returnValue().isPrimitive())
             fp->setReturnValue(ObjectValue(fp->constructorThis()));
         JS_RUNTIME_METER(cx->runtime, constructs);
     }
 
     return ok;
 }
 
--- a/js/src/tests/js1_5/extensions/jstests.list
+++ b/js/src/tests/js1_5/extensions/jstests.list
@@ -26,25 +26,23 @@ script regress-291213.js
 script regress-300079.js
 script regress-303277.js
 script regress-304897.js
 script regress-306738.js
 script regress-311161.js
 script regress-311583.js
 script regress-311792-01.js
 script regress-311792-02.js
-script regress-313500.js
 script regress-313763.js
 script regress-313803.js
 script regress-313938.js
 script regress-314874.js
 script regress-315509-02.js
 script regress-319683.js
 script regress-322957.js
-script regress-325269.js
 script regress-327608.js
 script regress-328443.js
 script regress-328556.js
 skip script regress-330569.js # Yarr doesn't bail on complex regexps.
 script regress-333541.js
 skip script regress-335700.js # bug xxx - reftest hang, BigO
 skip-if(!xulRuntime.shell) script regress-336409-1.js # no results reported.
 skip-if(!xulRuntime.shell&&xulRuntime.XPCOMABI.match(/x86_64/)) silentfail script regress-336409-2.js # can fail silently due to out of memory
deleted file mode 100644
--- a/js/src/tests/js1_5/extensions/regress-313500.js
+++ /dev/null
@@ -1,61 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is JavaScript Engine testing utilities.
- *
- * The Initial Developer of the Original Code is
- * Mozilla Foundation.
- * Portions created by the Initial Developer are Copyright (C) 2005
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s): Igor Bukanov
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-//-----------------------------------------------------------------------------
-var BUGNUMBER = 313500;
-var summary = 'Root access to "prototype" property';
-var actual = 'No Crash';
-var expect = 'No Crash';
-
-printBugNumber(BUGNUMBER);
-printStatus (summary);
-printStatus('This test requires TOO_MUCH_GC');
-
-function F() { }
-
-var prepared = new Object();
-
-F.prototype = {};
-F.__defineGetter__('prototype', function() {
-		     var tmp = prepared;
-		     prepared = null;
-		     return tmp;
-		   });
-
-new F();
- 
-reportCompare(expect, actual, summary);
deleted file mode 100644
--- a/js/src/tests/js1_5/extensions/regress-325269.js
+++ /dev/null
@@ -1,92 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is JavaScript Engine testing utilities.
- *
- * The Initial Developer of the Original Code is
- * Mozilla Foundation.
- * Portions created by the Initial Developer are Copyright (C) 2006
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s): Igor Bukanov
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-//-----------------------------------------------------------------------------
-var BUGNUMBER = 325269;
-var summary = 'GC hazard in js_ConstructObject';
-var actual = 'No Crash';
-var expect = 'No Crash';
-
-printBugNumber(BUGNUMBER);
-printStatus (summary);
-// only get exit code 3 if out of memory error occurs which
-// will not happen on machines with enough memory.
-// expectExitCode(3);
- 
-var SavedArray = Array;
-
-function Redirector() { }
-
-Redirector.prototype = 1;
-Redirector.__defineGetter__('prototype', function() {
-//        printStatus("REDIRECTOR");
-			      gc();
-			      return SavedArray.prototype;
-			    });
-
-//Array = Function('printStatus("Constructor")');
-try {
-    Array = Function('');
-} catch (e) { }
-
-if (Array === SavedArray) {
-  // No test of the hazard possible as the array is read-only
-  actual = expect;
-} else {
-  Array.prototype = 1;
-  Array.__defineGetter__('prototype', function() {
-//        printStatus("**** GETTER ****");
-      Array = Redirector;
-      gc();
-      new Object();
-      new Object();
-      return undefined;
-    });
-
-  new Object();
-
-  try
-  {
-    var y = "test".split('');
-  }
-  catch(ex)
-  {
-    printStatus(ex + '');
-  }
-}
-
-reportCompare(expect, actual, summary);
--- a/js/src/tests/js1_8_5/regress/jstests.list
+++ b/js/src/tests/js1_8_5/regress/jstests.list
@@ -49,8 +49,10 @@ script regress-598176.js
 script regress-600067.js
 script regress-600137.js
 script regress-601399.js
 script regress-602621.js
 fails-if(!xulRuntime.shell) script regress-607799.js
 fails-if(!xulRuntime.shell) script regress-607863.js
 script regress-610026.js
 script regress-609617.js
+script regress-617405-1.js
+script regress-617405-2.js
new file mode 100644
--- /dev/null
+++ b/js/src/tests/js1_8_5/regress/regress-617405-1.js
@@ -0,0 +1,11 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributors: Christian Holler <decoder@own-hero.net> and Jason Orendorff
+ */
+
+function C(){}
+C.prototype = 1;
+assertEq(Object.getOwnPropertyDescriptor(C, "prototype").configurable, false);
+
+reportCompare(0, 0, "ok");
new file mode 100644
--- /dev/null
+++ b/js/src/tests/js1_8_5/regress/regress-617405-2.js
@@ -0,0 +1,17 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributors: Christian Holler <decoder@own-hero.net> and Jason Orendorff
+ */
+
+function C(){}
+C.prototype = 1;
+try {
+    Object.defineProperty(C, "prototype", {get: function() { throw 0; }});
+    actual = "no exception";
+} catch (exc) {
+    actual = exc.name;
+}
+new C; // don't assert
+assertEq(actual, "TypeError");
+reportCompare(0, 0, "ok");