Closed Bug 390560 Opened 17 years ago Closed 17 years ago

js1_6/Regress/regress-382509.js FAIL browser - NS_ERROR_ILLEGAL_VALUE

Categories

(Core :: XPConnect, defect)

x86
All
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: bc, Assigned: mrbkap)

References

()

Details

(Keywords: regression)

Attachments

(1 file)

browser only, regressed after 2007073104 build.

  global.foo = eval;
  global.a   = 'global';
  expect = 'global indirect';
=>  actual = String(['a+" indirect"'].map(global.foo));

uncaught exception: [Exception... "Illegal value" nsresult: "0x80070057 (NS_ERROR_ILLEGAL_VALUE)" location: "JS frame :: http://test.mozilla.com/tests/mozilla.org/js/js1_6/Regress/regress-382509.js :: test :: line 61" data: no]

bug 389878 ?
Moving to a better component and removing the accidentally-set security flag.
Assignee: general → nobody
Group: security
Component: JavaScript Engine → XPConnect
QA Contact: general → xpconnect
Attached patch Proposed fixSplinter Review
I'd written this exact patch at some point, but must have decided I didn't need it for some (wrong) reason.
Assignee: nobody → mrbkap
Status: NEW → ASSIGNED
Attachment #274871 - Flags: superreview?(jst)
Attachment #274871 - Flags: review?(jst)
Comment on attachment 274871 [details] [diff] [review]
Proposed fix

You might want to complete the first sentence in the comment, other than that r+sr=jst
Attachment #274871 - Flags: superreview?(jst)
Attachment #274871 - Flags: superreview+
Attachment #274871 - Flags: review?(jst)
Attachment #274871 - Flags: review+
Comment on attachment 274871 [details] [diff] [review]
Proposed fix

This allows someone to pull a function off of a XOW and call it with a different 'this' object. The patch only affects this case, and should be very safe.
Attachment #274871 - Flags: approval1.9?
Blocks: xow
Attachment #274871 - Flags: approval1.9? → approval1.9+
Fix checked into trunk.
Status: ASSIGNED → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: