Closed Bug 1653212 Opened 3 months ago Closed 3 months ago

Issue parsing Latin1 String with number and `_` delimiter in the js shell

Categories

(Core :: JavaScript Engine, defect, P2)

x86_64
Linux
defect

Tracking

()

RESOLVED FIXED
mozilla80
Tracking Status
firefox-esr68 --- unaffected
firefox-esr78 --- wontfix
firefox78 --- wontfix
firefox79 --- wontfix
firefox80 --- fixed

People

(Reporter: cffsmith, Assigned: arai)

References

(Regression)

Details

(Keywords: regression)

Attachments

(1 file)

The following sample triggers an assertion failure:

function main() {
str = String.fromCharCode(0xff);
console.log(parse("1_" + str.toLocaleString()))
}
main();

Assertion failure: cp.isSome(), at /home/builder/firefox/js/src/util/Text.cpp:420

This is caused by the parse builtin in the jsshell, which reads the string with the Latin1 charset, then casts it to UTF-8 and then parses it (https://searchfox.org/mozilla-central/source/js/src/shell/js.cpp#5274). It then encounters the 1 and starts to parse a number, where _ can be used as a delimiter to make the number more readable and expects another number after the _. This fails which causes it to report an error in https://searchfox.org/mozilla-central/source/js/src/frontend/TokenStream.cpp#2420, which then tries to parse it as an UTF-8 string. This causes an infinite loop or an assertion failure in the DecodeOneUtf8CodePointInline function while trying to print an error message.

Thank you, Carl.

Shorter test case: parse("1_\xff")

What was I thinking when I reviewed this?

    const Latin1Char* chars_ = stableChars.latin1Range().begin().get();
    auto chars = reinterpret_cast<const mozilla::Utf8Unit*>(chars_);

Arai, would you mind taking this? We shouldn't leave it like that.

Severity: -- → S4
Flags: needinfo?(arai.unmht)
Priority: -- → P2
Assignee: nobody → arai.unmht
Status: NEW → ASSIGNED
Flags: needinfo?(arai.unmht)
Pushed by arai_a@mac.com:
https://hg.mozilla.org/integration/autoland/rev/c0d402ca2111
Use raw latin1 string only when it is ASCII. r=nbp
Status: ASSIGNED → RESOLVED
Closed: 3 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla80
You need to log in before you can comment on or make changes to this bug.