478501 - E4X truncate String when it found the '\0'.

Status: VERIFIED FIXED

(Tamarin Graveyard :: Virtual Machine, defect)

Description

[Jeff Dyer]

Steps to reproduce:

write following ActionScript code.
var s = "a" + String.fromCharCode(0) + "a";
trace(s.length);
trace(<e a={s}/>.toXMLString()); 
 
 Actual Results:
 3
<e a="a"/>
 
 Expected Results:
 3
<e a="a&#0;a"/> 
 
 
 Workaround (if any):
 
 
 
Transferred Comments:

Chris Peyer - Thu Apr 10 11:40:41 CDT 2008
Verified valid bug by Werner Sharp.

Trevor Baker - Tue Jan 27 16:30:13 CST 2009
send to internal review for prioritization


This bug transferred from: http://bugs.adobe.com/jira/browse/ASC-3116

Comment 1

[Michael Daumling]

Attachment: Fis adds to ECMA-357

The simple fix is to supply a length when creating the resulting string in AvmCore::EscapeAttributeValue(). This fix would produce the same output as in SpiderMonkey (which is still wrong - this is also a SpiderMonkey bug). Jeff's expected value is not covered in ECMA-357, where 0x00 is just an ordinary character. It does not hurt IMHO to add 0x00 as a value to be escaped as Jeff's expected result suggests.

Comment 2

[Lars T Hansen]

Comment on attachment 382117 [details] [diff] [review]
Fis adds to ECMA-357

(Steven gets superreview on builtin fixes.)

Comment 3

[Michael Daumling]

Patch pushed as #2018:96dc103550a9

Comment 4

[Brent Baker]

Attachment: testcase

Comment 5

[Brent Baker]

Comment on attachment 404629 [details] [diff] [review]
testcase

Pushed 2689:f822799a7fe3