Last Comment Bug 327897 - Crash [@ js_GetStringBytes] involving apply, __proto__, E4X
: Crash [@ js_GetStringBytes] involving apply, __proto__, E4X
Status: VERIFIED FIXED
[patch][rft-dl]
: crash, testcase, verified1.8.0.2, verified1.8.1
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: All All
: P1 critical (vote)
: mozilla1.9alpha1
Assigned To: Blake Kaplan (:mrbkap)
:
:
Mentors:
Depends on:
Blocks: 326633
  Show dependency treegraph
 
Reported: 2006-02-20 01:39 PST by Jesse Ruderman
Modified: 2011-06-13 10:01 PDT (History)
4 users (show)
dveditz: blocking1.8.0.2+
bob: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (97 bytes, text/html)
2006-02-20 01:41 PST, Jesse Ruderman
no flags Details
Talkback Record TB15420219 Windows/Win98 (29.75 KB, text/html)
2006-02-21 07:43 PST, Hermann Schwab
no flags Details
Fix (3.24 KB, patch)
2006-02-21 18:48 PST, Blake Kaplan (:mrbkap)
brendan: review+
brendan: approval‑branch‑1.8.1+
dveditz: approval1.8.0.2+
Details | Diff | Splinter Review

Description Jesse Ruderman 2006-02-20 01:39:38 PST
 
Comment 1 Jesse Ruderman 2006-02-20 01:41:32 PST
Created attachment 212454 [details]
testcase
Comment 2 Hermann Schwab 2006-02-21 07:43:30 PST
Created attachment 212590 [details]
Talkback Record TB15420219 Windows/Win98 

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20060212 SeaMonkey/1.5a
crash Talkback Record TB15420219W Seamonkey Trunk, Win98, so it isn't Mac only.
Comment 3 Blake Kaplan (:mrbkap) 2006-02-21 18:47:42 PST
This is easily fixed.
Comment 4 Blake Kaplan (:mrbkap) 2006-02-21 18:48:56 PST
Created attachment 212682 [details] [diff] [review]
Fix

The error message spat out is suboptimal, but close anyway. Chaining fallible functions together in a language without native exceptions is asking for trouble.
Comment 5 Brendan Eich [:brendan] 2006-02-21 19:07:47 PST
Comment on attachment 212682 [details] [diff] [review]
Fix

mrbkap: blame fur, I do ;-):

3.9          (fur%nets 14-Oct-98):                              JS_GetStringBytes(JS_ValueToString(cx, fval)));

r=me, good for 1.8.1 at least.

/be
Comment 6 Blake Kaplan (:mrbkap) 2006-02-21 19:51:50 PST
Fix checked into trunk.
Comment 7 Daniel Veditz [:dveditz] 2006-02-22 01:00:55 PST
Comment on attachment 212682 [details] [diff] [review]
Fix

approved for 1.8.0 branch, a=dveditz
Comment 8 Blake Kaplan (:mrbkap) 2006-02-22 12:50:24 PST
Fix checked into the 1.8 branches.
Comment 9 Bob Clary [:bc:] 2006-02-26 00:31:21 PST
Checking in regress-327897.js;
/cvsroot/mozilla/js/tests/e4x/Regress/regress-327897.js,v  <--  regress-327897.js
initial revision: 1.1
done
Comment 10 Dave Liebreich [:davel] 2006-03-01 14:04:24 PST
Marking [rft-dl] (ready for testing in Firefox 1.5.0.2 release candidates) since in-testsuite+ indicates a test case exists in the js test library.
Comment 11 Bob Clary [:bc:] 2006-03-02 12:09:31 PST
v ff 1.8.0.1/1.8/1.9 20060302 win/linux/mac

Note You need to log in before you can comment on or make changes to this bug.