js1_6/Regress/regress-382509.js FAIL browser - NS_ERROR_ILLEGAL_VALUE

RESOLVED FIXED

Status

()

RESOLVED FIXED
11 years ago
11 years ago

People

(Reporter: bc, Assigned: mrbkap)

Tracking

({regression})

Trunk
x86
All
regression
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(URL)

Attachments

(1 attachment)

(Reporter)

Description

11 years ago
browser only, regressed after 2007073104 build.

  global.foo = eval;
  global.a   = 'global';
  expect = 'global indirect';
=>  actual = String(['a+" indirect"'].map(global.foo));

uncaught exception: [Exception... "Illegal value" nsresult: "0x80070057 (NS_ERROR_ILLEGAL_VALUE)" location: "JS frame :: http://test.mozilla.com/tests/mozilla.org/js/js1_6/Regress/regress-382509.js :: test :: line 61" data: no]

bug 389878 ?
Moving to a better component and removing the accidentally-set security flag.
Assignee: general → nobody
Group: security
Component: JavaScript Engine → XPConnect
QA Contact: general → xpconnect
Created attachment 274871 [details] [diff] [review]
Proposed fix

I'd written this exact patch at some point, but must have decided I didn't need it for some (wrong) reason.
Assignee: nobody → mrbkap
Status: NEW → ASSIGNED
Attachment #274871 - Flags: superreview?(jst)
Attachment #274871 - Flags: review?(jst)
Comment on attachment 274871 [details] [diff] [review]
Proposed fix

You might want to complete the first sentence in the comment, other than that r+sr=jst
Attachment #274871 - Flags: superreview?(jst)
Attachment #274871 - Flags: superreview+
Attachment #274871 - Flags: review?(jst)
Attachment #274871 - Flags: review+
Comment on attachment 274871 [details] [diff] [review]
Proposed fix

This allows someone to pull a function off of a XOW and call it with a different 'this' object. The patch only affects this case, and should be very safe.
Attachment #274871 - Flags: approval1.9?

Updated

11 years ago
Blocks: 367911

Updated

11 years ago
Attachment #274871 - Flags: approval1.9? → approval1.9+
Fix checked into trunk.
Status: ASSIGNED → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.