312351 - The statement RegExp(null) crashes Firefox

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jillian]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b5) Gecko/20051006 Firefox/1.4.1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b5) Gecko/20051006 Firefox/1.4.1

When passing null to RegExp constructor, the browser crashes.

Reproducible: Always

Steps to Reproduce:
1. Evaluate RegExp(null) in the JavaScript console
 or put it in <script> node in a HTML page.


Actual Results:  
crash

Expected Results:  
Perhaps construct the regexp /^$/ ? so it'll match only empty strings.

Tested on Ff 1.0.7 and 1.5b2, Tb 1.0.7.

The module is js3250.dll

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Yeah, dereferencing NULL is a quick way do that. Safe patch upcoming.

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: No dereferencing null, please!

Comment 3

[Mike Shaver (:shaver emeritus)]

Comment on attachment 199451 [details] [diff] [review]
No dereferencing null, please!

r=shaver

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into trunk.

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 199451 [details] [diff] [review]
No dereferencing null, please!

This is a very trivial fix for an easy-to-hit crasher. It is a simple
null-check. The fix only affects callers of the RegExp constructor as a
function with only one argument, which is null.

Comment 6

[Bob Clary [:bc] (inactive)]

Checking in regress-312351.js;
/cvsroot/mozilla/js/tests/ecma_3/RegExp/regress-312351.js,v  <--  regress-312351.js
initial revision: 1.1
done

Comment 7

[Scott MacGregor]

since brendan already approved the patch, fixing up the blocker flag. 

Comment 8

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into MOZILLA_1_8_BRANCH.

Comment 9

[Bob Clary [:bc] (inactive)]

no crash firefox 1.5 rc2 winxp/linux

Comment 10

[Bob Clary [:bc] (inactive)]

v 1.8.0.1, 1.8, 1.9a1 20060217 win/linux/mac nightlies