452295 - segfault: echo 'eval("1")' | ./js

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Sam Ruby]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.1) Gecko/2008070208 Firefox/3.0.1
Build Identifier: 

With a current checkout of mozilla-central, built with "cd js/src; make -f Makefile.ref"

The following causes a segfault

echo 'eval("1")' | ./js

Neither of the following do:

echo 'eval("1")' | ./js -i
echo 'print(eval(1))' | ./js

Reproducible: Always

Steps to Reproduce:
1. echo 'eval("1")' | ./js

Actual Results:  
Segmentation fault (core dumped)

Expected Results:  
No output

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

I'm not sure if this is the right place for the assertion here...

Comment 2

[Brendan Eich [:brendan]]

Comment on attachment 335579 [details] [diff] [review]
Fix

Testing flags first seems better to me, because of common-case arguments: if the flag is not set more often than principals is null (I bet it is), then you want to bail there -- assuming perf is hyper-critical (which it is probably not, but the principle counts).

/be

Comment 3

[Brendan Eich [:brendan]]

Attachment: js.cpp patch I used to find the culprit

For future ref.

/be

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/index.cgi/mozilla-central/rev/b0b7959491f6

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

per previous duped bug, this occurs in 1.9.0.x and 1.8.1.x branches as well.

Comment 7

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Patch for the 1.9 branch

Comment 8

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Patch for the 1.8 branch

Comment 9

[Blake Kaplan (:mrbkap) (inactive)]

FWIW, the merges were trivial.

Comment 11

[David E. Ross]

The indicated platform is PC/Linux.  However, bug #457788 was closed as a duplicate of this one.  That bug applied to all platforms and operating systems.  It prevented me from installing Mnenhy 0.7.5 under SeaMonkey 1.1.12 (which was not released until after this bug was submitted) on Windows XP.  

I must therefore question whether this bug is indeed fixed for all platforms and whether it is actually a duplicate of bug #457788.

Comment 12

[Blake Kaplan (:mrbkap) (inactive)]

The fix hasn't landed on the stable branches yet, so you'll still crash with the latest version of Firefox. The bug was reported on PC/Linux and the fix was in cross-platform code. I have a bad habit of not updating the hardware/OS fields.

Comment 13

[Daniel Veditz [:dveditz]]

Comment on attachment 342618 [details] [diff] [review]
Patch for the 1.9 branch

Approved for 1.9.0.4, a=dveditz for release-drivers

Comment 14

[Daniel Veditz [:dveditz]]

Comment on attachment 342619 [details] [diff] [review]
Patch for the 1.8 branch

Approved for 1.8.1.18, a=dveditz for release-drivers

Comment 15

[Blake Kaplan (:mrbkap) (inactive)]

Checked in on the 1.8 and 1.9 branches.

Comment 16

[Bob Clary [:bc] (inactive)]

not possible to test in current framework unless someone can show me how to not have a principal.

Comment 17

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #16)
> not possible to test in current framework unless someone can show me how to not
> have a principal.

See bug 454040 for the branch testcases and comment #6 for the duplication.

Comment 18

[Bob Clary [:bc] (inactive)]

I'll do the test in bug 454040.

Comment 19

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_5/extensions/regress-454040.js,v  <-- 
regress-454040.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/f0e9fd501e63

Comment 20

[Bob Clary [:bc] (inactive)]

verified 1.9.1, 1.9.0, 1.8.1