522931 - textToSubURI.UnEscapeAndConvert("UTF-8", null) causes crash in NS_strdup [@strlen | NS_strdup(char const*) ]

Status: RESOLVED FIXED

(Core :: Internationalization, defect)

Description

[Makoto Kato [:m_kato]]

- Step
run
var textToSubURI = Components.classes["@mozilla.org/intl/texttosuburi;1"].getService(Components.interfaces.nsITextToSubURI); textToSubURI.UnEscapeAndConvert("UTF-8",null);

- Result
Crash in NS_strdup.

#3  0x00007ff4f5722fa5 in nsProfileLock::FatalSignalHandler (signo=11)
    at nsProfileLock.cpp:216
#4  <signal handler called>
#5  NS_strdup (aString=0x0) at nsCRTGlue.cpp:145
#6  0x00007ff4e2984093 in nsTextToSubURI::UnEscapeAndConvert (
    this=<value optimized out>, charset=0x17c0460 "UTF-8", text=0x0, 
    _retval=0xffffffffffffffff)
    at /home/makoto/Development/mozilla-hg/mozilla-central/intl/uconv/src/nsTextToSubURI.cpp:126
#7  0x00007ff4f47d015e in NS_InvokeByIndex_P (that=0x2aca8a0, methodIndex=4, 
    paramCount=<value optimized out>, params=0x7fffc3a8cc00)
    at /home/makoto/Development/mozilla-hg/mozilla-central/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_x86_64_unix.cpp:208
#8  0x00007ff4dd2b7d0f in XPCWrappedNative::CallMethod (ccx=..., 
    mode=<value optimized out>)

This crash seems to be sbumitted as long as I check crash-stats.

http://crash-stats.mozilla.com/report/list?product=Firefox&version=Firefox%3A3.7a1pre&platform=windows&query_search=signature&query_type=exact&query=&date=&range_value=1&range_unit=weeks&do_query=1&signature=strlen%20|%20NS_strdup%28char%20const*%29

Comment 1

[Makoto Kato [:m_kato]]

Attachment: patch v1

Comment 2

[Makoto Kato [:m_kato]]

also, this can repro on 3.6b2pre

http://crash-stats.mozilla.com/report/index/bp-cae0b0de-8029-44aa-9fc9-8e5672091018

Comment 3

[timeless]

do you really want to throw an exception?

Comment 4

[Makoto Kato [:m_kato]]

(In reply to comment #3)
> do you really want to throw an exception?

Parameter is invalid, so I think it should throw it.  Should we return null instead?

Comment 5

[Makoto Kato [:m_kato]]

Humm, until 1.9.1, UnEscapeAndConvert(charset, null) returns empty string instead of error or null.  I wil attach new patch...

Comment 6

[Makoto Kato [:m_kato]]

Attachment: patch v2

Comment 7

[Makoto Kato [:m_kato]]

Attachment: patch v2.1

Comment 8

[Makoto Kato [:m_kato]]

Comment on attachment 407235 [details] [diff] [review]
patch v2.1

modify patch after timeless comment.

Comment 9

[Makoto Kato [:m_kato]]

landed
http://hg.mozilla.org/mozilla-central/rev/89692081b401

Comment 10

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Comment on attachment 407235 [details] [diff] [review]
patch v2.1

a1.9.2=dbaron

Comment 11

[Makoto Kato [:m_kato]]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/02c55001a64a