Closed
Bug 620942
Opened 14 years ago
Closed 13 years ago
jsshell Clear uses obj uninitalized when argc==0
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
DUPLICATE
of bug 749392
People
(Reporter: timeless, Unassigned)
References
(Blocks 1 open bug, )
Details
(Keywords: coverity)
For reference, this is the xpcshell impl:
678 Clear(JSContext *cx, uintN argc, jsval *vp)
679 {
680 if (argc > 0 && !JSVAL_IS_PRIMITIVE(JS_ARGV(cx, vp)[0])) {
681 JS_ClearScope(cx, JSVAL_TO_OBJECT(JS_ARGV(cx, vp)[0]));
682 } else {
683 JS_ReportError(cx, "'clear' requires an object");
684 return JS_FALSE;
685 }
686 JS_SET_RVAL(cx, vp, JSVAL_VOID);
687 return JS_TRUE;
688 }
And here's the ipcshell impl:
519 Clear(JSContext *cx,
520 uintN argc,
521 jsval *vp)
522 {
523 jsval *argv = JS_ARGV(cx, vp);
524 if (argc > 0 && !JSVAL_IS_PRIMITIVE(argv[0])) {
525 JS_ClearScope(cx, JSVAL_TO_OBJECT(argv[0]));
526 } else {
527 JS_ReportError(cx, "'clear' requires an object");
528 return JS_FALSE;
529 }
530 JS_SET_RVAL(cx, vp, JSVAL_VOID);
531 return JS_TRUE;
532 }
unfortunately, this is the jsshell impl:
2612 Clear(JSContext *cx, uintN argc, jsval *vp)
2613 {
2614 JSObject *obj;
note that if argc == 0, then we do not continue in the if condition:
2615 if (argc != 0 && !JS_ValueToObject(cx, JS_ARGV(cx, vp)[0], &obj))
which means we can't return false:
2616 return JS_FALSE;
instead, we use obj which has not been initialized
2617 JS_ClearScope(cx, obj);
2618 JS_SET_RVAL(cx, vp, JSVAL_VOID);
2619 return JS_TRUE;
2620 }
At least at beginning of time, clear() didn't say it required any arguments.
Comment 1•13 years ago
|
||
Clear was removed.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → DUPLICATE
Updated•6 years ago
|
Blocks: coverity-analysis
You need to log in
before you can comment on or make changes to this bug.
Description
•