Closed Bug 652185 Opened 10 years ago Closed 10 years ago

js_XDRRegExpObject needs to anchor the source string

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: igor, Assigned: igor)

References

Details

(Keywords: crash, regression, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

See bug 648022 comment 20
Attached patch v1Splinter Review
adding missing Anchor
Attachment #527841 - Flags: review?(luke)
Luke: could you review this?
Would be nice if we could take an Anchored<T> in the same vein as AlreadyIncRefd<T> to categorically prevent this kind of js::RegExp creation error in the future.
Attachment #527841 - Flags: review?(luke) → review+
http://hg.mozilla.org/tracemonkey/rev/68aa67a995c6
Whiteboard: fixed-in-tracemonkey
http://hg.mozilla.org/mozilla-central/rev/68aa67a995c6
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Group: core-security
You need to log in before you can comment on or make changes to this bug.