373072 - XML.prototype.namespace() does not check for xml list

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Igor Bukanov]

xml_namespcae() from jsxml.c implementing XML.prototype.namespace() assumes that this obj can not be XMLList leading to NULL dereference in GetNamespace as the following js shell session demonstrates:

js> XML.prototype.function::namespace.call(new XMLList());
XML.prototype.function::namespace.call(new XMLList());
Segmentation fault

Comment 1

[Igor Bukanov]

Attachment: Minimal fix v1

This is a minimal fix that just makes sure that the code does not crash with xml-list argument and instead returns something. A fix with proper logic would be done in bug 373082.

Comment 2

[Brendan Eich [:brendan]]

Comment on attachment 257754 [details] [diff] [review]
Minimal fix v1

Yeah, that's what I meant to write -- at some point I ordered xml_class values such that JSXML_HAS_NAME worked, but I must have missed this open-coded test.

Thanks for fixing,

/be

Comment 3

[Igor Bukanov]

I committed the patch from comment 1 to the trunk:

Checking in jsxml.c;
/cvsroot/mozilla/js/src/jsxml.c,v  <--  jsxml.c
new revision: 3.145; previous revision: 3.144
done

Comment 4

[Mike Connor [:mconnor]]

Too late for 1.8.1.3/1.8.0.11 for this type of fix, moving nom out to 1.8.1.4/1.8.0.12

Comment 5

[Daniel Veditz [:dveditz]]

Comment on attachment 257754 [details] [diff] [review]
Minimal fix v1

approved for 1.8/1.8.0 branches, a=dveditz for drivers

Comment 6

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/e4x/XMLList/regress-373072.js,v  <--  regress-373072.js
initial revision: 1.1

Comment 7

[Bob Clary [:bc] (inactive)]

verified fixed 1.9.0 20070320 win/mac*/linux

Comment 8

[Igor Bukanov]

I committed the patch from comment 1 to MOZILLA_1_8_BRANCH:

Checking in jsxml.c;
/cvsroot/mozilla/js/src/jsxml.c,v  <--  jsxml.c
new revision: 3.50.2.61; previous revision: 3.50.2.60
done

Comment 9

[Igor Bukanov]

I committed the patch from comment 1 to MOZILLA_1_8_0_BRANCH:

Checking in jsxml.c;
/cvsroot/mozilla/js/src/jsxml.c,v  <--  jsxml.c
new revision: 3.50.2.15.2.31; previous revision: 3.50.2.15.2.30
done

Comment 10

[Bob Clary [:bc] (inactive)]

update test to reflect new error message from bug 373082.

/cvsroot/mozilla/js/tests/e4x/XMLList/regress-373072.js,v  <--  regress-373072.js
new revision: 1.2; previous revision: 1.1

verified fixed (no crash) 1.8.0, 1.8.1 linux, windows, mac shell 20070406