785805 - Segmentation fault when calling %ThrowError for message with three arguments

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Norbert Lindenberg]

Using the %ThrowError intrinsic from self-hosted code causes a segmentation fault if formatting a message with three arguments.

Comment 1

[Norbert Lindenberg]

Attachment: proposed patch

Comment 2

[Norbert Lindenberg]

Attachment: test case (not to be checked in)

After building with this patch, use the shell to run

    [].testThrowError();

This should throw an exception with the strings "arg 1", "arg 2", "arg 3" embedded in the message. It should not cause a segmentation fault.

Comment 3

[Norbert Lindenberg]

Attachment: proposed patch

Rebased to current mozilla-central, which did change the changed line (from int to unsigned), and improved the commit message.

Comment 4

[Till Schneidereit [:till]]

Comment on attachment 656312 [details] [diff] [review]
proposed patch

Review of attachment 656312 [details] [diff] [review]:
-----------------------------------------------------------------

Stealing review

Comment 5

[Till Schneidereit [:till]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/67c5a4852b9f

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/67c5a4852b9f