355478 - Crash with E4X, hasOwnProperty

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Jesse Ruderman]

js> new <x/>.hasOwnProperty("y")

Opt: crash [@ HasProperty], looks like a null deref.

Debug: assert [@ JS_GetPrivate]
Assertion failure: OBJ_GET_CLASS(cx, obj)->flags & JSCLASS_HAS_PRIVATE, at jsapi.c:2358

Comment 1

[Brendan Eich [:brendan]]

Old bug.

/bea

Comment 2

[Brendan Eich [:brendan]]

Attachment: fix

I checked, and all other xml_* methods begin with XML_METHOD_PROLOG, or call PutProperty or ToXMLString, which type-check obj.

/be

Comment 3

[Brendan Eich [:brendan]]

Checked into trunk:

Checking in jsxml.c;
/cvsroot/mozilla/js/src/jsxml.c,v  <--  jsxml.c
new revision: 3.130; previous revision: 3.129
done

/be

Comment 4

[Bob Clary [:bc] (inactive)]

Checking in regress-355478.js;
/cvsroot/mozilla/js/tests/e4x/Regress/regress-355478.js,v  <--  regress-355478.js
initial revision: 1.1
done

Comment 5

[Mike Schroepfer]

Comment on attachment 241358 [details] [diff] [review]
fix

Approved for RC3.

Comment 6

[Brendan Eich [:brendan]]

Fixed on the 1.8 branch:

Checking in jsxml.c;
/cvsroot/mozilla/js/src/jsxml.c,v  <--  jsxml.c
new revision: 3.50.2.48; previous revision: 3.50.2.47
done

/be

Comment 7

[Bob Clary [:bc] (inactive)]

verified fixed 1.9 20061007 windows/linux

Comment 8

[Daniel Veditz [:dveditz]]

Comment on attachment 241358 [details] [diff] [review]
fix

approved for 1.8.0 branch, a=dveditz for drivers

Comment 9

[Bob Clary [:bc] (inactive)]

verified fixed 20061009 1.8 windows/linux/mac* 1.9 windows/linux

Comment 10

[Brendan Eich [:brendan]]

Checking in jsxml.c;
/cvsroot/mozilla/js/src/jsxml.c,v  <--  jsxml.c
new revision: 3.50.2.15.2.23; previous revision: 3.50.2.15.2.22
done

/be

Comment 11

[Bob Clary [:bc] (inactive)]

verified fixed 1.8.0.8 20061014 windows/linux/mac*