Menu

#1828 NPE in native arrays if typed array has a null value

2.23
closed
RBRi
None
1
2016-10-06
2016-10-06
No

Was having some trouble with HtmlUnit processing some Google generated javascript. Turned out that the code they were using was like this:

var a = [];
a[3] = 1
var nativeArray = new Uint16Array(a);

The stack Trace would look like:
Caused by: java.lang.RuntimeException: Exception invoking constructor
at net.sourceforge.htmlunit.corejs.javascript.MemberBox.invoke(MemberBox.java:181)
at net.sourceforge.htmlunit.corejs.javascript.FunctionObject.call(FunctionObject.java:449)
at net.sourceforge.htmlunit.corejs.javascript.BaseFunction.construct(BaseFunction.java:389)
at net.sourceforge.htmlunit.corejs.javascript.Interpreter.interpretLoop(Interpreter.java:1591)
at net.sourceforge.htmlunit.corejs.javascript.Interpreter.interpret(Interpreter.java:798)
at net.sourceforge.htmlunit.corejs.javascript.InterpretedFunction.call(InterpretedFunction.java:105)
at net.sourceforge.htmlunit.corejs.javascript.ContextFactory.doTopCall(ContextFactory.java:411)
at com.gargoylesoftware.htmlunit.javascript.HtmlUnitContextFactory.doTopCall(HtmlUnitContextFactory.java:310)
at net.sourceforge.htmlunit.corejs.javascript.ScriptRuntime.doTopCall(ScriptRuntime.java:3286)
at net.sourceforge.htmlunit.corejs.javascript.InterpretedFunction.exec(InterpretedFunction.java:115)
at com.gargoylesoftware.htmlunit.javascript.JavaScriptEngine$3.doRun(JavaScriptEngine.java:738)
at com.gargoylesoftware.htmlunit.javascript.JavaScriptEngine$HtmlUnitContextAction.run(JavaScriptEngine.java:850)
... 36 more
Caused by: java.lang.NullPointerException
at com.gargoylesoftware.htmlunit.javascript.host.arrays.Uint32Array.toArray(Uint32Array.java:61)
at com.gargoylesoftware.htmlunit.javascript.host.arrays.ArrayBufferViewBase.put(ArrayBufferViewBase.java:148)
at com.gargoylesoftware.htmlunit.javascript.host.arrays.ArrayBufferViewBase.set(ArrayBufferViewBase.java:126)
at com.gargoylesoftware.htmlunit.javascript.host.arrays.ArrayBufferViewBase.constructor(ArrayBufferViewBase.java:90)
at com.gargoylesoftware.htmlunit.javascript.host.arrays.ArrayBufferViewBase.constructor(ArrayBufferViewBase.java:56)
at com.gargoylesoftware.htmlunit.javascript.host.arrays.Uint32Array.constructor(Uint32Array.java:51)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
at net.sourceforge.htmlunit.corejs.javascript.MemberBox.invoke(MemberBox.java:153)

Created a basic patch to return 0 for integer based toArrays() and NaN for floating point toArray() methods. (Which is the behavior of Chrome 53 and Firefox 47 (Both MacOS))

1 Attachments

Discussion

  • Michael Rimov

    Michael Rimov - 2016-10-06

    P.S. The patch was created against 2.23 tag

     
  • RBRi

    RBRi - 2016-10-06
    • status: open --> accepted
    • assigned_to: RBRi
     
  • RBRi

    RBRi - 2016-10-06
    • status: accepted --> closed
     
  • RBRi

    RBRi - 2016-10-06

    Thanks a lot, have applied your fix. You can get the lastest build from our ci server. Additionally i will make a new snapshot build available.

    Again man thanks

     

Log in to post a comment.