444233 - Passing JS object to SValStorageStatementBinder causes segfault [@ GetUTCTime - js_DateIsValid - JSValStorageStatementBinder]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Paul O'Shannessy [:zpao] (not bugmail, email directly)]

Using mozStorageStatementWrapper and passing an array ([1,2]) into params causes segfault.  Will attach test case and GDB backtrace.

Comment 1

[Paul O'Shannessy [:zpao] (not bugmail, email directly)]

Attachment: Test Case

Comment 2

[Paul O'Shannessy [:zpao] (not bugmail, email directly)]

Attachment: GDB Backtrace

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix

This is a testcase + the fix. This is a regression from bug 385393. In that bug, brendan made the "is this object a date" test conditional on being called from an interpreted function (with an argv array), but we need to the test unconditionally and only throw when called from an interpreted function.

Comment 4

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 329849 [details] [diff] [review]
Proposed fix

r=shaver, a comment in GetUTCTime explaining that this is why we do the vp thing would be extra-good.

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Pushed as http://hg.mozilla.org/index.cgi/mozilla-central/rev/3c1f72eddf61

Comment 7

[Henrik Skupin [:whimboo][⌚️UTC+1]]

As comment 3 said there was also a test checked-in. Updating some flags...

Do we also need this on 1.9.0.x branch? Bug 385393 was fixed a while ago during alpha 7 and alpha 8.

Comment 8

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 329849 [details] [diff] [review]
Proposed fix

This applies to the 1.9 branch.

Comment 9

[Samuel Sidler (old account; do not CC)]

Comment on attachment 329849 [details] [diff] [review]
Proposed fix

Approved for 1.9.0.2. Please land in CVS. a=ss

Comment 10

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into the 1.9 branch.

Comment 11

[Bob Clary [:bc] (inactive)]

storage/test/unit/test_bug-444233.js