47402 - Javascript crashes browser on incorrect method reassignment to base classes

Status: VERIFIED DUPLICATE of bug 33304

(Core :: JavaScript Engine, defect, P3)

Description

[hand]

From Bugzilla Helper:
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)
BuildID:    200072920

It assumes that the node is a Document where that may not necessarily be true 
and tries to call its getElementById method which it does not have.

Reproducible: Always
Steps to Reproduce:
1. Do the following assignment where TypeA and TypeB are built in types.

TypeA.prototype.oldMethod = TypeB.prototype.method
2. Call oldMethod of an object of TypeA that is not also of TypeB
3. Run the javascript

Actual Results:  Crash!

Expected Results:  It should provide a sensible error message.  One possibility 
is to prevent the assignment in the first place.  (Which is good for catching 
errors - but loses some functionality that I find use for)

The best option is to display a Javascript error when the attempt to call a non-
existant method occurs.

Comment 1

[hand]

Attachment: Open crash.xul in the mozilla browser

Comment 2

[Tomer Brisker]

Confirmed on linux 2000080108. Changing OS/Plat to all. It gives me an XUL alert
before crashing. Adding crash keyword.

Comment 3

[John Bandhauer]

It seems likely to me that this is a bug in the DOM's reflection objects and not 
in the JS engine.

Comment 4

[hand]

The XUL alert is to demonstrate that the javascript has started executing 
before mozilla crashes and show the success of the original method call.

Comment 5

[Brendan Eich [:brendan]]

Indeed, this is a dup of one of jst's bugs.

/be

*** This bug has been marked as a duplicate of 33304 ***

Comment 6

[Phil Schwartau]

Verifying duplicate -