Closed
Bug 344804
Opened 19 years ago
Closed 19 years ago
Iterating over window.Packages crashes both Firefox and Java, [@ strlen] called by js_ExpandErrorArguments
Categories
(Core :: JavaScript Engine, defect, P2)
Core
JavaScript Engine
Tracking
()
VERIFIED
FIXED
mozilla1.8.1beta2
People
(Reporter: jruderman, Assigned: mrbkap)
References
()
Details
(Keywords: crash, testcase, verified1.8.1)
Crash Data
Attachments
(3 files)
|
49 bytes,
text/html
|
Details | |
|
25.23 KB,
text/plain
|
Details | |
|
2.15 KB,
patch
|
brendan
:
review+
mtschrep
:
approval1.8.1+
|
Details | Diff | Splinter Review |
Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20060713 Minefield/3.0a1
Loading the testcase causes both Firefox and Java to crash. I don't know if that means both are buggy, or what. (I get a Firefox crash reporter dialog with JavaScript stuff on the stack, but if I look in Console.app I see that Java has also crashed.)
I discovered this while trying to use the testcase in bug 344759.
|
Reporter | |
Comment 1•19 years ago
|
||
|
|
Reporter | |
Comment 2•19 years ago
|
||
|
|
Reporter | |
Updated•19 years ago
|
Summary: Iterating over window.Packages crashes both Firefox and Java → Iterating over window.Packages crashes both Firefox and Java, [@ strlen] called by js_ExpandErrorArguments
|
|
Reporter | |
Updated•19 years ago
|
Product: Firefox → Core
QA Contact: tabbed.browser → tabbed-browser
|
|
Reporter | |
Updated•19 years ago
|
Assignee: nobody → general
Component: Tabbed Browser → JavaScript Engine
QA Contact: tabbed-browser → general
this is a regression from the patch in bug 326466.
js_ValueToPrintableSource is allowed to "return" null (e.g. js_ValueToSource does) and http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/js/src/jsfun.c&rev=3.159&mark=2259#2228 doesn't check that.
|
||
Comment 4•19 years ago
|
||
Yeah, this is probably the crash I saw, which I mentioned in bug 344759, comment 3.
|
Assignee | |
Comment 5•19 years ago
|
||
Sadly, this lets the error that js_ValueToSource throws trump the 'invalid iterator' message. I'm not sure if we really want that, but what value would we use otherwise?
|
|
Assignee | |
Updated•19 years ago
|
OS: Mac OS X 10.4 → All
Priority: -- → P2
Hardware: Macintosh → All
Target Milestone: --- → mozilla1.8.1beta2
|
||
Comment 6•19 years ago
|
||
Comment on attachment 229676 [details] [diff] [review]
Silly fix
We do the same all over. An error on the way to reporting another error trumps. Usually it's OOM, and you've paged to death.
/be
Attachment #229676 -
Flags: review?(brendan) → review+
|
|
Assignee | |
Comment 7•19 years ago
|
||
Checked in.
Status: ASSIGNED → RESOLVED
Closed: 19 years ago
Resolution: --- → FIXED
|
||
Comment 8•19 years ago
|
||
Checking in regress-344804.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-344804.js,v <-- regress-344804.js
initial revision: 1.1
Flags: in-testsuite+
|
|
||
Comment 9•19 years ago
|
||
Comment on attachment 229676 [details] [diff] [review]
Silly fix
This missed the js1.7 landing somehow, needs to get on the 1.8 branch.
/be
Attachment #229676 -
Flags: approval1.8.1?
|
||
Updated•19 years ago
|
Attachment #229676 -
Flags: approval1.8.1? → approval1.8.1+
|
|
||
Comment 11•19 years ago
|
||
verified fixed 1.8.1, 1.9 windows/mac(ppc|tel)/linux 20060728
Status: RESOLVED → VERIFIED
Keywords: fixed1.8.1 → verified1.8.1
|
|
Reporter | |
Comment 12•19 years ago
|
||
See also bug 349964, "Iterating over window.Packages halts JavaScript execution, even in 'try' block".
|
||
Updated•14 years ago
|
Crash Signature: [@ strlen]
You need to log in
before you can comment on or make changes to this bug.
Description
•