417893 - Crash [@ JS_Enumerate]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

(function() { var s = function(){}.prototype.toSource; s(); })()


Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000000

Thread 0 Crashed:
0   js 	0x0001a3d1 JS_Enumerate + 29 (jsapi.c:3821)
1   js 	0x00086a08 MarkSharpObjects + 240 (jsobj.c:370)
2   js 	0x00086dda js_EnterSharpObject + 293 (jsobj.c:467)
3   js 	0x00087356 obj_toSource + 285 (jsobj.c:636)
4   js 	0x0007440c js_Interpret + 83825 (jsinterp.c:4654)
5   js 	0x0005e822 js_Execute + 794 (jsinterp.c:1653)
6   js 	0x0001c295 JS_ExecuteScript + 54 (jsapi.c:4805)
7   js 	0x00002339 Process + 883 (js.c:306)
8   js 	0x00002c2b ProcessArgs + 2005 (js.c:537)
9   js 	0x000086c3 main + 617 (js.c:3628)
10  js 	0x00001cc6 _start + 216
11  js 	0x00001bed start + 41

Comment 1

[Brendan Eich [:brendan]]

Attachment: fast natives must use JS_THIS/JS_THIS_OBJECT and check for errors

I'm surprised the js testsuite never hit these cases. Jesse, thanks for catching and please suppress any dup bugs.

/be

Comment 2

[Brendan Eich [:brendan]]

Since fast natives haven't shipped in a standalone SpiderMonkey release, my INCOMPATIBILITY NOTICE comment in jsapi.h is overblown. I'll adjust it, but please review (and let me know if you think it should stand).

/be

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 303818 [details] [diff] [review]
fast natives must use JS_THIS/JS_THIS_OBJECT and check for errors

While you're here, want to patch IteratorNext in XPCWrapper.cpp as well?

Thanks.

Comment 5

[Brendan Eich [:brendan]]

Attachment: with XPCWrapper.cpp per mrbkap

Comment 6

[Brendan Eich [:brendan]]

Attachment: generic-primitive methods in jsstr.c needed help too, plus a few others

Comment 7

[Brendan Eich [:brendan]]

Fixed:

js/src/jsapi.c 3.416
js/src/jsapi.h 3.184
js/src/jsarray.c 3.156
js/src/jsdate.c 3.101
js/src/jsexn.c 3.97
js/src/jsfun.c 3.260
js/src/jsiter.c 3.91
js/src/jsobj.c 3.435
js/src/jsregexp.c 3.188
js/src/jsscript.c 3.170
js/src/jsstr.c 3.194
js/src/jsxml.c 3.193
js/src/xpconnect/src/XPCWrapper.cpp 1.20

/be

Comment 8

[Bob Clary [:bc] (inactive)]

Checking in regress-417893.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-417893.js,v  <--  regress-417893.js
initial revision: 1.1

Comment 9

[Bob Clary [:bc] (inactive)]

v