295052 - Crash when apply method is called on String.prototype.match

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[David James]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4 (ax)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4 (ax)

The following Javascript code will crash both Firefox and Mozilla:
   "".match.apply()

Reproducible: Always

Steps to Reproduce:
Type the following code into a webpage or the Javascript console and execute it:
   "".match.apply()
Actual Results:  
Mozilla / Firefox crashes.

Expected Results:  
It should have executed the match method.

I've tested this with Firefox 1.04 and Mozilla 1.7.1 on Windows XP. 

In Mozilla 1.7.1:
AppName: mozilla.exe	 AppVer: 1.7.20040.5185	 ModName: js3250.dll
ModVer: 4.0.0.0	 Offset: 0003ca05

In Firefox 1.0.4:
Will add crash report in comment.

Comment 1

[David James]

In Firefox 1.0.4:
AppName: firefox.exe	 AppVer: 1.0.4.0	 ModName: js3250.dll
ModVer: 4.0.0.0	 Offset: 0003dc67

Comment 2

[David James]

Attachment: This HTML page will crash Firefox or Mozilla

Test Case

Comment 3

[David James]

Switching to normal priority

Comment 4

[Steve England [:stevee]]

Crashes for me Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.8)
Gecko/20050509 Firefox/1.0.4
Crashes for me Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2)
Gecko/20050521 Firefox/1.0+ ID:2005052110

Comment 5

[Steve England [:stevee]]

TB6020777W [@ js3250.dll]

Comment 6

[Ben Fowler]

Attachment: Backtrace

I am not certain, but I think that the line in question is
http://lxr.mozilla.org/seamonkey/source/js/src/jsstr.c#1181 where we 
de-reference a pointer to bytecode, cx->fp->down->pc , which is null.

Comment 7

[Brendan Eich [:brendan]]

Attachment: fix

Comment 8

[Bob Clary [:bc] (inactive)]

Checking in js1_5/Regress/regress-295052.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-295052.js,v  <--  regress-295052.js
initial revision: 1.1

Comment 9

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 184201 [details] [diff] [review]
fix

r=shaver

Comment 10

[Daniel Veditz [:dveditz]]

Comment on attachment 184201 [details] [diff] [review]
fix

Approving for branches

Comment 11

[Brendan Eich [:brendan]]

Fixed on the trunk.  Will land on branches after tomorrow.

/be

Comment 12

[timeless]

brendan: ping

Comment 13

[Brendan Eich [:brendan]]

Fixed on AVIARY_1_0_1_20050124_BRANCH and MOZILLA_1_7_BRANCH.

/be

Comment 14

[sairuh (rarely reading bugmail)]

verified fixed with 200506170x-1.0.5 firefox builds on linux fc3 and mac os x
10.4.1. neither the test URL nor the attached test case crash the builds.