327897 - Crash [@ js_GetStringBytes] involving apply, __proto__, E4X

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

Comment 1

[Jesse Ruderman]

Attachment: testcase

Comment 2

[Hermann Schwab]

Attachment: Talkback Record TB15420219 Windows/Win98

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20060212 SeaMonkey/1.5a
crash Talkback Record TB15420219W Seamonkey Trunk, Win98, so it isn't Mac only.

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

This is easily fixed.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

The error message spat out is suboptimal, but close anyway. Chaining fallible functions together in a language without native exceptions is asking for trouble.

Comment 5

[Brendan Eich [:brendan]]

Comment on attachment 212682 [details] [diff] [review]
Fix

mrbkap: blame fur, I do ;-):

3.9          (fur%nets 14-Oct-98):                              JS_GetStringBytes(JS_ValueToString(cx, fval)));

r=me, good for 1.8.1 at least.

/be

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into trunk.

Comment 7

[Daniel Veditz [:dveditz]]

Comment on attachment 212682 [details] [diff] [review]
Fix

approved for 1.8.0 branch, a=dveditz

Comment 8

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into the 1.8 branches.

Comment 9

[Bob Clary [:bc] (inactive)]

Checking in regress-327897.js;
/cvsroot/mozilla/js/tests/e4x/Regress/regress-327897.js,v  <--  regress-327897.js
initial revision: 1.1
done

Comment 10

[Dave Liebreich [:davel]]

Marking [rft-dl] (ready for testing in Firefox 1.5.0.2 release candidates) since in-testsuite+ indicates a test case exists in the js test library.

Comment 11

[Bob Clary [:bc] (inactive)]

v ff 1.8.0.1/1.8/1.9 20060302 win/linux/mac