Passing JS object to SValStorageStatementBinder causes segfault [@ GetUTCTime - js_DateIsValid - JSValStorageStatementBinder]

VERIFIED FIXED in mozilla1.9.1a1

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
10 years ago
7 years ago

People

(Reporter: zpao, Assigned: mrbkap)

Tracking

({crash, fixed1.9.0.2, regression})

Trunk
mozilla1.9.1a1
crash, fixed1.9.0.2, regression
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(3 attachments)

Using mozStorageStatementWrapper and passing an array ([1,2]) into params causes segfault.  Will attach test case and GDB backtrace.

Updated

10 years ago
Severity: normal → critical
Keywords: crash
Summary: Passing JS object to SValStorageStatementBinder causes segfault → Passing JS object to SValStorageStatementBinder causes segfault [@ GetUTCTime - js_DateIsValid - JSValStorageStatementBinder]

Updated

10 years ago
Attachment #328593 - Attachment mime type: application/x-javascript → text/plain
(Assignee)

Comment 3

10 years ago
Created attachment 329849 [details] [diff] [review]
Proposed fix

This is a testcase + the fix. This is a regression from bug 385393. In that bug, brendan made the "is this object a date" test conditional on being called from an interpreted function (with an argv array), but we need to the test unconditionally and only throw when called from an interpreted function.
Assignee: nobody → mrbkap
Status: NEW → ASSIGNED
Attachment #329849 - Flags: review?(shaver)
(Assignee)

Updated

10 years ago
Blocks: 385393
Comment on attachment 329849 [details] [diff] [review]
Proposed fix

r=shaver, a comment in GetUTCTime explaining that this is why we do the vp thing would be extra-good.
Attachment #329849 - Flags: review?(shaver) → review+
(Assignee)

Comment 5

10 years ago
Pushed as http://hg.mozilla.org/index.cgi/mozilla-central/rev/3c1f72eddf61
Status: ASSIGNED → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED
Status: RESOLVED → VERIFIED
Duplicate of this bug: 446136
As comment 3 said there was also a test checked-in. Updating some flags...

Do we also need this on 1.9.0.x branch? Bug 385393 was fixed a while ago during alpha 7 and alpha 8.
Component: Storage → JavaScript Engine
Flags: in-testsuite+
Keywords: regression
OS: Mac OS X → All
Product: Toolkit → Core
QA Contact: storage → general
Hardware: PC → All
Target Milestone: --- → mozilla1.9.1a1
(Assignee)

Comment 8

10 years ago
Comment on attachment 329849 [details] [diff] [review]
Proposed fix

This applies to the 1.9 branch.
Attachment #329849 - Flags: approval1.9.0.2?
Comment on attachment 329849 [details] [diff] [review]
Proposed fix

Approved for 1.9.0.2. Please land in CVS. a=ss
Attachment #329849 - Flags: approval1.9.0.2? → approval1.9.0.2+
(Assignee)

Comment 10

10 years ago
Fix checked into the 1.9 branch.
Keywords: fixed1.9.0.2

Comment 11

8 years ago
storage/test/unit/test_bug-444233.js
Crash Signature: [@ GetUTCTime - js_DateIsValid - JSValStorageStatementBinder]
You need to log in before you can comment on or make changes to this bug.