boa-dev/boa

panic: character was not a valid digit

langston-barrett opened this issue · 1 comments

Found with tree-crasher on 0e01a74.

SDPUtils = {};

SDPUtils.generateIdentifier = function() {
   Math.random()
    .toString(36)
    .substr(2, 10);
};

SDPUtils.localCName = SDPUtils.generateIdentifier();

The panic doesn't always happen.

{

}
undefined
{
length: 0,
name: "",
prototype: {
constructor: [Cycle]
    }
}
undefined
thread 'main' panicked at 'character was not a valid digit', boa_engine/src/builtins/number/mod.rs:594:34
stack backtrace:
   0: rust_begin_unwind
             at /rustc/2c8cc343237b8f7d5a3c3703e3a87f2eb2c54a74/library/std/src/panicking.rs:575:5
   1: core::panicking::panic_fmt
             at /rustc/2c8cc343237b8f7d5a3c3703e3a87f2eb2c54a74/library/core/src/panicking.rs:64:14
   2: core::panicking::panic_display
             at /rustc/2c8cc343237b8f7d5a3c3703e3a87f2eb2c54a74/library/core/src/panicking.rs:147:5
   3: core::panicking::panic_str
             at /rustc/2c8cc343237b8f7d5a3c3703e3a87f2eb2c54a74/library/core/src/panicking.rs:131:5
   4: core::option::expect_failed
             at /rustc/2c8cc343237b8f7d5a3c3703e3a87f2eb2c54a74/library/core/src/option.rs:1924:5
   5: boa_engine::builtins::number::Number::to_string
   6: boa_engine::vm::code_block::<impl boa_engine::object::jsobject::JsObject>::call_internal
   7: boa_engine::object::internal_methods::function::function_call{{reify.shim}}
   8: <boa_engine::vm::opcode::call::Call as boa_engine::vm::opcode::Operation>::execute
   9: boa_engine::vm::<impl boa_engine::context::Context>::run
  10: boa_engine::vm::code_block::<impl boa_engine::object::jsobject::JsObject>::call_internal
  11: boa_engine::object::internal_methods::function::function_call{{reify.shim}}
  12: <boa_engine::vm::opcode::call::Call as boa_engine::vm::opcode::Operation>::execute
  13: boa_engine::vm::<impl boa_engine::context::Context>::run
  14: boa_engine::context::Context::execute
  15: boa_engine::context::Context::eval_script
  16: boa::main
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

Math.random().toString(radix); sometimes crashes for radix > 16. It looks like it never happens for radix <= 16.

reproducible with

while (true) {
    Math.random().toString(17);
}