361360 - "Assertion failure: !caller || caller->pc" in obj_eval involving setter and watch

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Jesse Ruderman]

js> this.__defineSetter__('x', eval); this.watch('x', function(){}); x = 3;
Assertion failure: !caller || caller->pc, at jsobj.c:1220

Security-sensitive because other bugs involving setter and watch are security-sensitive.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

This is bug 355341's cousin. I wonder if we should make the pseudo frame's pc be the end of its script or something...

I think this is a simple null deref. crash (which manifests itself as an assertion in debug builds).

Comment 2

[Brendan Eich [:brendan]]

Please don't over-use the s-s setting.

/be

Comment 3

[Brendan Eich [:brendan]]

Attachment: fix

Like this?  Want to point at a real bytecode, not past end of vector, of course.

/be

Comment 4

[Brendan Eich [:brendan]]

Pure null deref or assertbotch.

/be

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 246184 [details] [diff] [review]
fix

Yeah, this is what I had in mind.

Comment 6

[Brendan Eich [:brendan]]

Fixed on trunk:

Checking in jsdbgapi.c;
/cvsroot/mozilla/js/src/jsdbgapi.c,v  <--  jsdbgapi.c
new revision: 3.74; previous revision: 3.73
done

/be

Comment 7

[Brendan Eich [:brendan]]

Comment on attachment 246184 [details] [diff] [review]
fix

Essentially a one-line fix to avoid a null deref crash.

/be

Comment 8

[Bob Clary [:bc] (inactive)]

RCS file: /cvsroot/mozilla/js/tests/js1_5/Regress/regress-361360.js,v
done
Checking in regress-361360.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-361360.js,v  <--  regress-361360.js
initial revision: 1.1
done

Comment 9

[Jay Patel [:jay]]

Comment on attachment 246184 [details] [diff] [review]
fix

Approved for 1.8.1 branch, a=jay for drivers.  Please land asap, thanks!

Comment 10

[Brendan Eich [:brendan]]

Want patch for bug 361467 along with this bug's patch.

/be

Comment 11

[Bob Clary [:bc] (inactive)]

verified fixed 20061122 1.9 windows/linux

Comment 12

[Brendan Eich [:brendan]]

revision 3.56.2.6
date: 2006/11/23 19:36:24;  author: brendan%mozilla.org;  state: Exp;  lines: +12 -3
Fix 361360 and 361467, a=jay.

/be

Comment 13

[Bob Clary [:bc] (inactive)]

verified fixed 20061125 1.8.1.1, windows/linux/mac*, 1.9 windows/linux, note test passes in 1.8.0.9.