Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-51581

JavaScript object corruption due to Array.concat

    XMLWordPrintable

    Details

      Description

      A strange object corruption problem happens when using a 3rd party JavaScript library, possibly due to Array.concat. Unfortunately I wasn't able to extract a smaller piece of code that demonstrates the problem, so I'm putting it here in full.

      When you run the attached QML example file, you'll see two outputs logged by the code that I added manually to the attached js file at line 3118. The second logging will have the "corrupt" object. Line 5225 seems like the culprit.

      The problem doesn't present when the library is used in browsers or nodejs.

      You can see the original issue here:
      https://github.com/andrewplummer/Sugar/issues/543

        Attachments

        1. CorruptionDemo.qml
          0.2 kB
        2. sugar_modified.js
          350 kB

          Issue Links

          is related to

          Bug - A problem which impairs or prevents the functions of the product. QTBUG-69024 Function from js-file becomes global for all files.

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. QTBUG-81037 Array.concat does not verify length against allocated space

          • P1: Critical - Urgent and Important, will STOP the release if matched with set FixVersion field. This includes regressions from the last version that are not edge cases; Data loss; Build issues; All but the most unlikely crashes/lockups/hanging; Serious usability issues and embarrassing bugs & Bugs critical to a deliverable. This is the highest possible priority for requirements.
          • Closed
          For Gerrit Dashboard: QTBUG-51581
          # Subject Branch Project Status CR V
          222768,14 Ensure we read context properties before the global object dev qt/qtdeclarative Status: MERGED +2 0
          223769,2 Fix out of bounds reads in Array.concat 5.11 qt/qtdeclarative Status: MERGED +2 0
          223887,2 Fix out of bounds reads in Array.concat 5.9 qt/qtdeclarative Status: MERGED +2 0

            Activity

              People

              • Assignee:
                laknoll Lars Knoll
                Reporter:
                bgr bgr
              • Votes:
                1 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Gerrit Reviews

                  There are no open Gerrit changes