374160 - Crash [@ JS_InstanceOf] with E4X..@c[0] = 3

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

js> <a><b c="1"></b><b c="2"></b></a>..@c[0] = 3;

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x0000000c

Thread 0 Crashed:
0   js 	0x00015b59 JS_InstanceOf + 16 (jsapi.c:2292)
1   js 	0x00015d46 JS_GetInstancePrivate + 38 (jsapi.c:2336)
2   js 	0x000d5026 PutProperty + 53 (jsxml.c:4208)
3   js 	0x000d5809 PutProperty + 2072 (jsxml.c:4405)
4   js 	0x000d768a xml_setProperty + 93 (jsxml.c:5131)
5   js 	0x00067853 js_Interpret + 57921 (jsinterp.c:3827)
6   js 	0x000587a2 js_Execute + 715 (jsinterp.c:1612)
7   js 	0x0001a108 JS_ExecuteScript + 54 (jsapi.c:4212)
8   js 	0x00002992 Process + 912 (js.c:268)
9   js 	0x00003314 ProcessArgs + 1910 (js.c:494)
10  js 	0x00007ed9 main + 612 (js.c:3159)
11  js 	0x000024a6 _start + 216
12  js 	0x000023cd start + 41

Comment 1

[Igor Bukanov]

Attachment: Fix v1

The reason for the bug is that after <a><b c="1"></b><b c="2"></b></a>..@c[0] = 3; one gets a list with attribute elements with parents not yet dressed with objects.     Hence the code must use GetXMLObject.

Comment 2

[Brendan Eich [:brendan]]

Comment on attachment 259354 [details] [diff] [review]
Fix v1

Sorry I missed this request!

/be

Comment 3

[Igor Bukanov]

Attachment: Fix v1b

Patch to commit synced with CVS head.

Comment 4

[Igor Bukanov]

I committed the patch from comment 3 to the trunk:

Checking in jsxml.c;
/cvsroot/mozilla/js/src/jsxml.c,v  <--  jsxml.c
new revision: 3.152; previous revision: 3.151
done

Comment 5

[Igor Bukanov]

This is a safe fix for null pointer segfault.

Comment 6

[Daniel Veditz [:dveditz]]

Not really a "blocker", but we'll approve the patch.

Comment 7

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/e4x/Regress/regress-374160.js,v  <--  regress-374160.js
initial revision: 1.1

Comment 8

[Igor Bukanov]

Attachment: 1.8.1 version of v1b

The patch is the result of a trivial merger into 1.8.1 branch.

Comment 9

[Igor Bukanov]

Comment on attachment 260672 [details] [diff] [review]
1.8.1 version of v1b

The patch applies to 1.8.0 except in the hunk that removes a trailing whitespace: that blank does not exist in 1.8.0.

Comment 10

[Igor Bukanov]

Comment on attachment 260048 [details] [diff] [review]
Fix v1b

The branches require a separated patch.

Comment 11

[Bob Clary [:bc] (inactive)]

verified fixed linux, windows, mac* shell 20070406

Comment 12

[Daniel Veditz [:dveditz]]

Comment on attachment 260672 [details] [diff] [review]
1.8.1 version of v1b

approved for 1.8.0.12 and 1.8.1.4, a=dveditz for release-drivers

Comment 13

[Igor Bukanov]

I committed the patch from comment 8 to MOZILLA_1_8_BRANCH:

Checking in jsxml.c;
/cvsroot/mozilla/js/src/jsxml.c,v  <--  jsxml.c
new revision: 3.50.2.64; previous revision: 3.50.2.63
done

Comment 14

[Igor Bukanov]

I committed the patch from comment 8 to MOZILLA_1_8_0_BRANCH:

Checking in jsxml.c;
/cvsroot/mozilla/js/src/jsxml.c,v  <--  jsxml.c
new revision: 3.50.2.15.2.34; previous revision: 3.50.2.15.2.33
done

Comment 15

[Bob Clary [:bc] (inactive)]

verified fixed 1.8.0, 1.8.1, windows, mac*, linux 2007-04-08