114493 - blowout on out-of-bounds array invocation as function

Status: VERIFIED FIXED

(Rhino Graveyard :: Compiler, defect)

Description

[Tomas Rokicki]

E:\p4test\main\dev>java -version
java version "1.2.2"
Java HotSpot(TM) Server VM (2.0rc1, mixed mode, build I)

E:\p4test\main\dev>java -jar e:/rhino/js.jar
js> "3"[5]()
Exception in thread "main" java.lang.ArrayIndexOutOfBoundsException
        at org.mozilla.javascript.Interpreter.getString(Interpreter.java:1132)
        at org.mozilla.javascript.Interpreter.interpret(Interpreter.java:1942)
        at org.mozilla.javascript.InterpretedScript.call(InterpretedScript.java:
68)
        at org.mozilla.javascript.InterpretedScript.exec(InterpretedScript.java:
59)
        at org.mozilla.javascript.Context.evaluateReader(Context.java:773)
        at org.mozilla.javascript.tools.shell.Main.evaluateReader(Main.java:293)

        at org.mozilla.javascript.tools.shell.Main.processSource(Main.java:217)
        at org.mozilla.javascript.tools.shell.Main.exec(Main.java:104)
        at org.mozilla.javascript.tools.shell.Main.main(Main.java:66)

Comment 1

[Phil Schwartau]

I'm also seeing this. Compare SpiderMonkey:

js>  "3"[5]();
1: TypeError: "3"[5] is not a function

Comment 2

[Phil Schwartau]

Testcase added to JS testsuite:

          mozilla/js/tests/js1_5/Regress/regress-114493.js

Comment 3

[Norris Boyd]

Fixed:

Checking in Interpreter.java;
/cvsroot/mozilla/js/rhino/src/org/mozilla/javascript/Interpreter.java,v  <--  In
terpreter.java
new revision: 1.61; previous revision: 1.60
done

Comment 4

[Phil Schwartau]

Verified FIXED. The construct produces a TypeError instead of crashing.
The testcase above now passes in both the rhino and rhinoi shells.

Comment 5

[Igor Bukanov]

Targeting as resolved against 1.5R3