248458 - Crash [@ nsJSIID::Equals] for null other

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[timeless]

steps to reproduce:
1. run xpcshell
2.
js> Components.interfaces.nsISupports.equals(null)

Expected result:
 false or an exception

Actual result:
crash

>	xpc3250.dll!nsJSIID::Equals(nsIJSID * other=0x00000000, int *
_retval=0x0012e864)  Line 439 + 0x3	C++
 	xpcom.dll!XPTC_InvokeByIndex(nsISupports * that=0x00f4b0c8, unsigned int
methodIndex=0x00000007, unsigned int paramCount=0x00000002, nsXPTCVariant *
params=0x0012e854)  Line 102	C++
 	xpc3250.dll!XPCWrappedNative::CallMethod(XPCCallContext & ccx={...},
XPCWrappedNative::CallMode mode=CALL_METHOD)  Line 2028 + 0x16	C++

Reproduced w/ trunk.

Comment 1

[timeless]

Attachment: handle null

Comment 2

[Christian :Biesinger (don't email me, ping me on IRC)]

untrusted code can crash mozilla this way, too... see url field

Comment 3

[David Bradley]

nsJSID::Equals returns an error on this condition same. I'm wondering if they
should behave the same. I'm not saying that nsJSID::Equals is necessarily the
right behavior.

Comment 4

[David Bradley]

Comment on attachment 151603 [details] [diff] [review]
handle null

Doh, ok, retval != other. So this will make it behave the same as
nsJSID::Equals

Comment 5

[David Bradley]

Oh, and I'd add a check for null of _retval as well like nsJSID::Equals does 

Comment 6

[Mike Shaver (:shaver emeritus)]

Comment on attachment 151603 [details] [diff] [review]
handle null

sold.

Comment 7

[timeless]

mozilla/js/src/xpconnect/src/xpcjsid.cpp 	1.64