107771 - String.prototype.lastIndexOf counts on 0 termination of JSSTRING_CHARS

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Sean Kendall Schneyer]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.5+)
Gecko/20011030
BuildID:    2001103003

When going to the above URL, Javascript is used to redirect the user to
https://web1.e-travel.com/etravel40/bin/ETWebDll.dll/welcome?UserGroup=ericsson
In Mozilla, however, you are redirect to
https://web1.e-travel.com/etravel40/bin/ETWebDll.dll/welcome?UserGroup= instead.
The Javascript used is listed below:
---
var path = new String(document.location);
  k = path.lastIndexOf('/');
  if (k == path.length-1) {
    path = path.substring(0, k);
    k = path.lastIndexOf('/');
  }  

  var user_group = new String(path.substring(k+1, path.length));
  var html = new String;
  html = '/etravel40/bin/ETWebDll.dll/welcome?UserGroup=';
  html += user_group;
  top.location.href = html;
---

Reproducible: Always
Steps to Reproduce:
1. Go to https://web1.e-travel.com/ericsson
2. Redirected to
https://web1.e-travel.com/etravel40/bin/ETWebDll.dll/welcome?UserGroup= 


Actual Results:  Redirected to wrong URL:
https://web1.e-travel.com/etravel40/bin/ETWebDll.dll/welcome?UserGroup= 

Expected Results:  Redirected to correct URL:
https://web1.e-travel.com/etravel40/bin/ETWebDll.dll/welcome?UserGroup=ericsson

Comment 1

[Alex Vincent [:WeirdAl]]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:0.9.5+) Gecko/20011031

Testcase in one moment.

Comment 2

[Alex Vincent [:WeirdAl]]

Attachment: Testcase, simplified

Comment 3

[Alex Vincent [:WeirdAl]]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:0.9.5+) Gecko/20011031

This is a regression from Mozilla 0.9.5 milestone, which correctly evaluates
this testcase.

Comment 4

[Brendan Eich [:brendan]]

This stinks of my dependent string fix for bug 56940.

/be

Comment 5

[Brendan Eich [:brendan]]

Fixing summary.  I hope there aren't more like this -- I'll look around.

/be

Comment 6

[Brendan Eich [:brendan]]

Attachment: proposed fix, give me fast r= and sr= please!

Comment 7

[Brendan Eich [:brendan]]

A `grep '[a-z]\[.* == [a-zA-Z_][a-zA-Z0-9_]*\[' js*.[ch]` shows no other such
bad conditions.  I think this is it.  Our testcase failed to catch it, but will
once phil creates a regression test for this bug.

I have r=jag over my shoulder; jband, are you around?

/be

Comment 8

[Brendan Eich [:brendan]]

Comment on attachment 56017 [details] [diff] [review]
proposed fix, give me fast r= and sr= please!

Got r=jag, sr=waterson, woohoo!

/be

Comment 9

[Brendan Eich [:brendan]]

Fixed.

/be

Comment 10

[Sean Kendall Schneyer]

I am totally impressed with the turnaround on this fix! Thanks, I'm confirming
that it works for me with the latest build.

Comment 11

[Alex Vincent [:WeirdAl]]

Agreed -- Mozilla/5.0 (Windows; U; Win98; en-US; rv:0.9.5+)
Gecko/20011101 testcase now passes :)

Comment 12

[Phil Schwartau]

Testcase added to JS testsuite:

          mozilla/js/tests/js1_5/String/regress-107771.js

Testcase passes in debug and optimized JS shells built 2001-11-01 WinNT.
Based on this and the results indicated above, marking VERIFIED FIXED.