290291 - Unchecked JS_GetPrivate calls in DOMJSClass_toString

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Mike Shaver (:shaver emeritus)]

As in bug 290162, we trust too much that we will only get objects of the
appropriate class as |this| for this method.  Crashing test case, due to deref
of bogus pointer:

javascript:a=new Number(0x12345678);a.toString=Node.toString;alert(a)

(Sadly, perhaps, I can't use Node.toString.call, because it doesn't exist,
though Node.toString has a typeof "function".)

Not sure if the obvious fix (JS_GetInstancePrivate against sDOMJSClass) is
correct here, because I don't quite have all of the delegation model wired up in
my head at this hour.

Comment 1

[Daniel Veditz [:dveditz]]

nominating to get on the radar

Comment 2

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Attachment: patch to fix

Comment 3

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

I changed the assertion to a warning since this can happen without error on our
side.

Comment 4

[Mike Shaver (:shaver emeritus)]

Comment on attachment 180750 [details] [diff] [review]
patch to fix

In a more perfect world, we'd throw something like INVALID_ARG, but this will
more than do for 1.0.3.  r+sr=shaver, requesting approval for branch and trunk.

Comment 5

[Asa Dotzler [:asa]]

Comment on attachment 180750 [details] [diff] [review]
patch to fix

a=asa

Comment 6

[Chase Phillips]

Comment on attachment 180750 [details] [diff] [review]
patch to fix

a=chase for branches

Comment 7

[Brendan Eich [:brendan]]

jst thought peterv may have written this native method; cc'ing him so he can
repent and sin no more ;-).

/be

Comment 8

[Brendan Eich [:brendan]]

Attachment: fix

Comment 9

[Brendan Eich [:brendan]]

Fixed everywhere.

/be

Comment 10

[sairuh (rarely reading bugmail)]

tested with the 2005041422-1.0.3 ffox build on linux fc3, I no longer crash with
the test case in comment 0 (entering it in the Location field).

Comment 11

[Tracy Walker [:tracy]]

looks good on Fx trunk build 2005-04-15-07-trunk

No crash with the following error in js console:

Error: uncaught exception: [Exception... "Could not convert JavaScript argument
arg 0 [nsIDOMWindowInternal.alert]"  nsresult: "0x80570009
(NS_ERROR_XPC_BAD_CONVERT_JS)"  location: "JS frame :: javascript:a=new
Number(0x12345678);a.toString=Node.toString;alert(a) :: <TOP_LEVEL> :: line 1" 
data: no]