355341 - Crash with watch and setter [@ js_PCToLineNumber] [@ Function]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Jesse Ruderman]

js> this.x setter= Function; this.watch('x', function () { }); x = 3;
Bus error

I'm making this bug security-sensitive for now because the stack in an opt jsshell looks strange:

Thread 0 Crashed:
0   js 	0x00013c28 js_PCToLineNumber + 28 (crt.c:355)
1   <<00000000>> 	0xbfffe83c 0 + -1073747908
2   js 	0x00012b44 Function + 240 (crt.c:355)
3   js 	0x00033534 js_Invoke + 1548 (crt.c:355)
4   js 	0x00033990 js_InternalInvoke + 204 (crt.c:355)
...

Comment 1

[Brendan Eich [:brendan]]

This is a null deref only crash.

/be

Comment 2

[Brendan Eich [:brendan]]

Attachment: fix

Often internal APIs do not null-defend, but in case any callers in addition to Function want to pass fp->pc, this will test in one place only and return the invalid line number (0).

/be

Comment 3

[Igor Bukanov]

One more thing about the previous attachment. It changes ToXMLName to use ConvertToString to ensure that String instances with overwritten String.prototype.toString still uses the default ToString conversion. But that required that SanitizeValue skips string converssion for Number, Boolean and String object instances.

Comment 4

[Igor Bukanov]

Ignore prev comments, wrong bug.

Comment 5

[Brendan Eich [:brendan]]

Comment on attachment 241515 [details] [diff] [review]
fix

Simple null defense in the function that needs it.

/be

Comment 6

[Brendan Eich [:brendan]]

Fixed on trunk:

Checking in jsscript.c;
/cvsroot/mozilla/js/src/jsscript.c,v  <--  jsscript.c
new revision: 3.117; previous revision: 3.116
done

/be

Comment 7

[Bob Clary [:bc] (inactive)]

Checking in regress-355341.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-355341.js,v  <--  regress-355341.js
initial revision: 1.1
done

Comment 8

[Bob Clary [:bc] (inactive)]

verified fixed 1.9 20061007 windows/linux

Comment 9

[Daniel Veditz [:dveditz]]

Comment on attachment 241515 [details] [diff] [review]
fix

approved for 1.8 branch, a=dveditz for drivers

Comment 10

[Brendan Eich [:brendan]]

Checking in jsscript.c;
/cvsroot/mozilla/js/src/jsscript.c,v  <--  jsscript.c
new revision: 3.79.2.18; previous revision: 3.79.2.17
done

/be

Comment 11

[Bob Clary [:bc] (inactive)]

verified fixed 20061130 1.8.1.1 windows/linux/mac*