449152 - valgrind umr in js1_5/extensions/regress-435345-01.js

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Bob Clary [:bc] (inactive)]

==28877== Conditional jump or move depends on uninitialised value(s)
==28877==    at 0x47BA71: obj_watch(JSContext*, unsigned, long*)
(jsobj.cpp:1437)
==28877==    by 0x4FFD67: js_Interpret (jsinterp.cpp:4928)
==28877==    by 0x466F5E: js_Execute (jsinterp.cpp:1553)
==28877==    by 0x40EDA8: JS_ExecuteScript (jsapi.cpp:4926)
==28877==    by 0x40A590: Process(JSContext*, JSObject*, char*, int)
(js.cpp:272)
==28877==    by 0x40AD32: ProcessArgs(JSContext*, JSObject*, char**, int)
(js.cpp:500)
==28877==    by 0x40B0AC: main (js.cpp:3967)

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

We need to ensure that we write to all out parameters when we're about to bail.

If we can't get information about the attributes, 0 is just as good a value as any.

Comment 2

[Brian Crowder]

changeset:   16403:0da3b307d627

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 332294 [details] [diff] [review]
Fix

While this isn't exploitable, it might be nice to get this into 1.9.0.2.

I'm not sure what our testing policy is for testing bugs like this -- by its nature, this could cause random behavior (watching properties on a dense array will randomly fail to call the watch function).

Comment 4

[Samuel Sidler (old account; do not CC)]

Comment on attachment 332294 [details] [diff] [review]
Fix

Approved for 1.9.0.2. Please land in CVS. a=ss

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Checked into the 1.9 branch.

Comment 6

[Bob Clary [:bc] (inactive)]

verified 1.9.0/1.9.1 linux shell/browser