Problems with toString function performed on Function objects

VERIFIED FIXED in mozilla0.9.8

Status

()

Core
JavaScript Engine
P1
major
VERIFIED FIXED
16 years ago
13 years ago

People

(Reporter: christian bodart, Assigned: brendan)

Tracking

({crash, js1.5})

Trunk
mozilla0.9.8
crash, js1.5
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(4 attachments)

(Reporter)

Description

16 years ago
try the following:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
	<title>Untitled</title>
</head>
<body>
<script>
var x = {}
x.fun = function () {return 'hello'}
x.fun.toString = function () {
return this();
}
onload = function () {
  alert(x.fun)
}


</script>
</body>
</html>

this should work (and does in NS4 and all IE browsers) but results in crashing 
mozilla
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: crash

Comment 1

16 years ago
cc'ing Brendan on this. We can reduce the browser crash to this:

obj = {};
obj.toString = function() {return this();}
obj;


If we change |this()| to |this|, we do not crash and there are no
errors in the JavaScript Console.


VARIATIONS

If you change the property name from |toString| to |prop|, no crash
and no error. If you change the final line from |obj;| to |obj.toString();|
as in

obj = {};
obj.toString = function() {return this();}
obj.toString();


then no crash, but we get an error:

Error: object is not a function
Line: 2



NONE of the testcases above crash for me in the standalone JS shell
on WinNT (optimized or debug).
Assignee: rogerl → khanson

Comment 2

16 years ago
Created attachment 62423 [details]
Reduced HTML testcase; crashes Mozilla

Comment 3

16 years ago
Created attachment 62424 [details]
WinNT stack trace

Comment 4

16 years ago
Crashes Mozilla 20011219xx on Linux as well as WinNT.
OS : Win ---> All
OS: Windows 2000 → All
(Assignee)

Comment 5

16 years ago
D'oh -- old bug (I think) -- JSOP_THIS does not null the obj register.

/be
Assignee: khanson → brendan
Keywords: js1.5, mozilla0.9.8
Priority: -- → P1
Hardware: PC → All
Target Milestone: --- → mozilla0.9.8
(Assignee)

Comment 6

16 years ago
Created attachment 62495 [details] [diff] [review]
proposed fix, one-liner
Comment on attachment 62495 [details] [diff] [review]
proposed fix, one-liner

sr=shaver.
Attachment #62495 - Flags: superreview+

Comment 8

16 years ago
Comment on attachment 62495 [details] [diff] [review]
proposed fix, one-liner

r=timeless (see also bug 53614)
Attachment #62495 - Flags: review+
(Assignee)

Comment 9

16 years ago
Fixed, thanks.

/be
Status: NEW → RESOLVED
Last Resolved: 16 years ago
Resolution: --- → FIXED

Comment 10

16 years ago
Created attachment 62873 [details]
Reporter's original HTML testcase

Comment 11

16 years ago
Verified Fixed using Mozilla trunk binaries 20011227xx on WinNT, Linux, Mac9.1.
Both the reduced HTML testcase and the reporter's original testcase load without 
crashing. I also checked in the latest JS shell built today, and did not crash. 
On the other hand, I was never able to provoke the crash there anyway -
Status: RESOLVED → VERIFIED

Updated

13 years ago
Flags: testcase?

Comment 12

13 years ago
Checking in regress-116228.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-116228.js,v  <--  regress-116228.js
initial revision: 1.1
Flags: testcase? → testcase+
You need to log in before you can comment on or make changes to this bug.