panic: character was not a valid digit
langston-barrett opened this issue · 1 comments
langston-barrett commented
Found with tree-crasher on 0e01a74.
SDPUtils = {};
SDPUtils.generateIdentifier = function() {
Math.random()
.toString(36)
.substr(2, 10);
};
SDPUtils.localCName = SDPUtils.generateIdentifier();
The panic doesn't always happen.
{
}
undefined
{
length: 0,
name: "",
prototype: {
constructor: [Cycle]
}
}
undefined
thread 'main' panicked at 'character was not a valid digit', boa_engine/src/builtins/number/mod.rs:594:34
stack backtrace:
0: rust_begin_unwind
at /rustc/2c8cc343237b8f7d5a3c3703e3a87f2eb2c54a74/library/std/src/panicking.rs:575:5
1: core::panicking::panic_fmt
at /rustc/2c8cc343237b8f7d5a3c3703e3a87f2eb2c54a74/library/core/src/panicking.rs:64:14
2: core::panicking::panic_display
at /rustc/2c8cc343237b8f7d5a3c3703e3a87f2eb2c54a74/library/core/src/panicking.rs:147:5
3: core::panicking::panic_str
at /rustc/2c8cc343237b8f7d5a3c3703e3a87f2eb2c54a74/library/core/src/panicking.rs:131:5
4: core::option::expect_failed
at /rustc/2c8cc343237b8f7d5a3c3703e3a87f2eb2c54a74/library/core/src/option.rs:1924:5
5: boa_engine::builtins::number::Number::to_string
6: boa_engine::vm::code_block::<impl boa_engine::object::jsobject::JsObject>::call_internal
7: boa_engine::object::internal_methods::function::function_call{{reify.shim}}
8: <boa_engine::vm::opcode::call::Call as boa_engine::vm::opcode::Operation>::execute
9: boa_engine::vm::<impl boa_engine::context::Context>::run
10: boa_engine::vm::code_block::<impl boa_engine::object::jsobject::JsObject>::call_internal
11: boa_engine::object::internal_methods::function::function_call{{reify.shim}}
12: <boa_engine::vm::opcode::call::Call as boa_engine::vm::opcode::Operation>::execute
13: boa_engine::vm::<impl boa_engine::context::Context>::run
14: boa_engine::context::Context::execute
15: boa_engine::context::Context::eval_script
16: boa::main
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.
vfosnar commented
Math.random().toString(radix);
sometimes crashes for radix > 16
. It looks like it never happens for radix <= 16
.
reproducible with
while (true) {
Math.random().toString(17);
}