450871 - Crash [@ str_lastIndexOf] with proto and lastIndexOf

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: crash log

__proto__ = <x/>; <x/>.lastIndexOf(this, false)

I found and reduced to the testcase above, it crashes latest trunk js shell, both opt and debug at null.

1.9.0.x js shell works as expected, which shows the message "typein:1: TypeError: XML.prototype.toString called on incompatible global".

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

The typos were introduced by the patch for bug 412296.

Comment 3

[Igor Bukanov]

Comment on attachment 334108 [details] [diff] [review]
Fix

Sorry about the typos.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

For the purpose of automated testing, here is another crash testcase involving IndexOf instead of lastIndexOf:

__proto__ = <x/>; <x/>.indexOf(this)

A similar crash that crashes at null and at str_indexOf.

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/index.cgi/mozilla-central/rev/07e5b301501a

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Verifying in both opt and debug js shells. They now work as expected.

Console output:

$ ./js-trunk-intelmac
js> __proto__ = <x/>; <x/>.lastIndexOf(this, false)
typein:1: TypeError: XML.prototype.toString called on incompatible global
js> __proto__ = <x/>; <x/>.indexOf(this)
typein:2: TypeError: XML.prototype.toString called on incompatible global
js>

Comment 7

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/e4x/extensions/regress-450871-01.js,v  <--  regress-450871-01.js
initial revision: 1.1

/cvsroot/mozilla/js/tests/e4x/extensions/regress-450871-02.js,v  <--  regress-450871-02.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/a4ac2862212d