630939 - Constructor function name retrieved incorrectly

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Steve Fink [:sfink] [:s:]]

When JSD grabs the name of a constructor to hold onto, it uses incorrect types and interprets a JSString* as a char*. This would produce an invalid string, and a possible crash from reading invalid memory. I haven't observed any negative effects; I just noticed the compile warning.

Comment 1

[Steve Fink [:sfink] [:s:]]

Attachment: Convert JSString to char* for constructor names

Comment 2

[David Mandelin [:dmandelin]]

Seems not to be a regression, so I think it doesn't block. We'll gladly approve it for landing though if it gets r+.

Comment 3

[timeless]

Comment on attachment 509171 [details] [diff] [review]
Convert JSString to char* for constructor names

sorry, this definitely feels like a regression from when someone changed the JS api to hand out Id's instead of Char*s.

please try to match file style until file style is cleaned up.

that means 

+                if ( (ctorName = JS_EncodeString(cx, ctorNameStr)) ) {

should be:

+                if( (ctorName = JS_EncodeString(cx, ctorNameStr)) ) {

Note that I do not happen to like this style, it's merely the style the file uses and as I've been noting elsewhere I have been unable to get it changed because I couldn't get reviews for anything.

Comment 4

[Steve Fink [:sfink] [:s:]]

http://hg.mozilla.org/tracemonkey/rev/04b5492cc109

Comment 5

[Steve Fink [:sfink] [:s:]]

http://hg.mozilla.org/mozilla-central/rev/04b5492cc109