Closed Bug 108832 Opened 23 years ago Closed 23 years ago

Mozilla crashes at this site [@ js_strncpy]

Categories

(Core :: JavaScript Engine, defect, P2)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
All
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
mozilla0.9.7

People

(Reporter: bugzilla, Assigned: brendan)

References

(
URL
)

Details

(Keywords: crash, js1.5)

Crash Data

Attachments

(4 files)

bactrace, linux 2001-110706
3.21 KB, text/plain
Details
Windows stack trace -- obvious passing array boundaries
3.36 KB, patch
Details | Diff | Splinter Review
minimal proposed fix for 0.9.6
553 bytes, patch
shaver
: review+
jband_mozilla
: superreview+
Details | Diff | Splinter Review
proposed larger fix, good for 0.9.7 trunk
3.71 KB, patch
shaver
: review+
jband_mozilla
: superreview+
Details | Diff | Splinter Review
going to: http://www.bgbank.dk/link/konkurrence crashes mozilla build 20011106 TB37679342Y
Severity: normal → critical
Keywords: crash
Same here with 2001110612 under Linux. No talkback triggered.
OS: Windows 2000 → All
adding to summary
Summary: http://www.bgbank.dk/link/konkurrence crashes mozilla → http://www.bgbank.dk/link/konkurrence crashes mozilla [js_strncpy]
Assignee: av → rogerl
Component: Plug-ins → Javascript Engine
QA Contact: shrir → pschwartau
--> JavaScript based on the stack trace.
I get the same stack trace as Andrei with a debug build 2001-11-06 on WinNT. cc'ing Brendan on this one -
Assignee: rogerl → khanson
Summary: http://www.bgbank.dk/link/konkurrence crashes mozilla [js_strncpy] → Mozilla crashes at this site [@ js_strncpy]
Argh, js_strchr is toxic nowadays, given dependent strings. This should be fixed ASAP for 0.9.6. /be
Assignee: khanson → brendan
Keywords: js1.5, mozilla0.9.6
Target Milestone: --- → mozilla0.9.6
khanson, jband, shaver: please r= and sr= for 0.9.6 so Asa can a=. Thanks, /be
Comment on attachment 57043 [details] [diff] [review] minimal proposed fix for 0.9.6 sr=jband
Attachment #57043 - Flags: superreview+
Comment on attachment 57043 [details] [diff] [review] minimal proposed fix for 0.9.6 Yeah, r=shaver, but let's keep it open for a better fix post-0.9.6, OK?
Attachment #57043 - Flags: review+
shaver: le plus certainement, better fix may keep js_strnchr for the safe nul-terminated uses, but avoid flattening in do_replace by providing a js_FindChar or some such. Asa: a= for checkin today? Thanks, /be
a=asa (on behalf of drivers) for checkin to 0.9.6
Keywords: mozilla0.9.6 → mozilla0.9.6+
Checked in for 0.9.6, lowering severity and setting priority for 0.9.7. /be
Severity: critical → normal
Status: NEW → ASSIGNED
Keywords: mozilla0.9.7
Priority: -- → P2
Target Milestone: mozilla0.9.6 → mozilla0.9.7
QA note: Verified Fixed with the minimal fix that has been checked in so far. Using binaries 20011111xx Linux, 20011113xx WinNT, 20011115xx Mac9.1. Site now loads without crashing (whether or not Flash plug-in is installed).
Comment on attachment 58502 [details] [diff] [review] proposed larger fix, good for 0.9.7 trunk r=shaver.
Attachment #58502 - Flags: review+
Comment on attachment 58502 [details] [diff] [review] proposed larger fix, good for 0.9.7 trunk sr=jband
Attachment #58502 - Flags: superreview+
Fix checked in, thanks. /be
Status: ASSIGNED → RESOLVED
Closed: 23 years ago
Resolution: --- → FIXED
Verified Fixed using Mozilla trunk binaries 20011120xx WinNT, Linux, Mac 9.1 Site now loads without crashing (whether or not Flash plug-in is installed).
Status: RESOLVED → VERIFIED
Crash Signature: [@ js_strncpy]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: