653789 - Crash [@ js_CheckForStringIndex] or [@ js::DefaultValue]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stacks

__defineGetter__("x", eval);
eval.toString = toLocaleString
eval < x

crashes js debug shell on TM changeset 3dd6ec45084c without -m nor -j at js_CheckForStringIndex and crashes js opt shell at js::DefaultValue

Comment 1

[Jeff Walden [:Waldo]]

Attachment: Patch and tests

toLocaleString can straightforwardly recur through all-native functions.  Also, it didn't implement the spec algorithm.  Funny, that, how methods not written in the steps of the spec turn out to be buggy.

Comment 2

[Jeff Walden [:Waldo]]

Oh, a simpler test:

"" + { toString: Object.prototype.toLocaleString };

Comment 3

[Luke Wagner [:luke]]

Comment on attachment 529203 [details] [diff] [review]
Patch and tests

Oops, I missed the initial review request.  Nice test.

Comment 4

[Jeff Walden [:Waldo]]

http://hg.mozilla.org/tracemonkey/rev/897963a18985

I noticed before landing that I had another test which I'd somehow forgotten to add to the patch.  It's basically comment 2, so not too tricky to need a look or anything.

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This already landed on mozilla-central some time ago.

http://hg.mozilla.org/mozilla-central/rev/897963a18985

Comment 6

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929