Closed Bug 331664 Opened 18 years ago Closed 18 years ago

Null ptr deref crash deleting XML methods

Categories

(Core :: JavaScript Engine, defect, P1)

Product:
Core
Component:
JavaScript Engine
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
mozilla1.9alpha1

People

(Reporter: brendan, Assigned: brendan)

References

(
URL
)

Details

(Keywords: crash, verified1.8.0.4, verified1.8.1)

Attachments

(1 file)

fix
1.11 KB, patch
mrbkap
: review+
brendan
: approval-branch-1.8.1+
jay
: approval1.8.0.4+
Details | Diff | Splinter Review 
See the URL.  Trivial bug, fix in a moment.

/be
Status: NEW → ASSIGNED
Priority: -- → P1
Attached patch fix — — Splinter Review 
array is initialized to null near the top of DeleteProperty, and length to 0.

/be
Attachment #216189 - Flags: review?(mrbkap)
Attachment #216189 - Flags: approval1.8.0.3?
Attachment #216189 - Flags: approval-branch-1.8.1+
Comment on attachment 216189 [details] [diff] [review]
fix

r=mrbkap
Attachment #216189 - Flags: review?(mrbkap) → review+
Fixed on trunk and 1.8 branch.

/be
Status: ASSIGNED → RESOLVED
Closed: 18 years ago
Keywords: fixed1.8.1
Resolution: --- → FIXED
Comment on attachment 216189 [details] [diff] [review]
fix

Please check in promptly on the 1.8.0 branch.  Thanks!
Attachment #216189 - Flags: approval1.8.0.3? → approval1.8.0.3+
Checking in regress-331664.js;
/cvsroot/mozilla/js/tests/e4x/Regress/regress-331664.js,v  <--  regress-331664.js
initial revision: 1.1
Flags: in-testsuite+
verified fixed 1.8.1/1.9a1 win/mac/linux 20060415
Status: RESOLVED → VERIFIED
Keywords: fixed1.8.1 → verified1.8.1
Fixed on 1.8.0 branch.

/be
Keywords: fixed1.8.0.3
verified fixed 20060425 1.8.0.4 win/mac/linux
Keywords: fixed1.8.0.4 → verified1.8.0.4
Keywords: crash
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: