New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 914409 link

Starred by 4 users
Status: Fixed
Owner:
neis@chromium.org
Closed: Dec 18
Cc:
vamshi.kommuri@chromium.org
leszeks@chromium.org
█ dhai@google.com
habl...@google.com
neis@chromium.org
mathias@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug



Sign in to add a comment

Spread string with emoji produces holey array

Reported by a...@scirra.com, Dec 12 
UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.80 Safari/537.36

Steps to reproduce the problem:
1. Spread a string with an emoji, e.g. [..."😃"]

What is the expected behavior?
["😃"]

What went wrong?
["😃", undefined]

Did this work before? N/A 

Chrome version: 71.0.3578.80  Channel: stable
OS Version: 10.0
Flash Version: 

This reproduces in stable 71.0.3578.80. It appears to be fixed in Canary 73.0.3638.0. However this is a serious problem: it can crash any web apps that reasonably assume a spread string will produce an array of strings. For example our web app Construct 3 (editor.construct.net) can crash if you enter an emoji in to a string because of this. So it may warrant a patch on the stable branch.

Comment 1 by woxxom@gmail.com, Dec 12 

Broken in 71.0.3574.0 by 760eed0525e9b571408120eb5d3e9c511f9065d6 via r597569
Fixed in 72.0.3591.0 by 902d21dd661033427b56d5f93c12b12339bf55ab via r602419

Comment 2 by chrishtr@chromium.org, Dec 12

Components: -Blink Blink>JavaScript

Comment 3 by swarnasree.mukkala@chromium.org, Dec 13

Labels: Needs-Triage-M71

Comment 4 by vamshi.kommuri@chromium.org, Dec 13

Cc: dhai@google.com vamshi.kommuri@chromium.org
Labels: Triaged-ET Needs-Feedback
Thanks for filing the issue!

Tried checking the issue on reported chrome version 71.0.3578.80 using Windows 10 with the below mentioned steps.
1. Launched Chrome
2. Inspected the page and Pasted "😃" in DevTools Console
3. Didn't observe any error. 
Attaching the screenshot of the same for reference. 
From comment#1 cc'ing "Hai Dang" for further inputs.

@Reporter: Could you please share a sample test file to check the issue and please let us know if the process followed here isn't correct. Any further inputs from your end may be helpful.
914409.png
727 KB View Download

Comment 5 by a...@scirra.com, Dec 13 

You didn't follow the right steps. The repro is to use [..."😃"], not just "😃".
Project Member

Comment 6 by sheriffbot@chromium.org, Dec 13

Labels: -Needs-Feedback
Thank you for providing more feedback. Adding the requester to the cc list.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 7 by mathias@chromium.org, Dec 18

Cc: mathias@chromium.org neis@chromium.org leszeks@chromium.org

Comment 8 by leszeks@google.com, Dec 18 

Probably because M71 is missing https://chromium-review.googlesource.com/c/v8/v8/+/1297320

Comment 9 by leszeks@google.com, Dec 18 

Oh, I see there's a bisect finding that already :)

Comment 10 by mathias@chromium.org, Dec 18 

Any code point greater than U+FFFF can be used to reproduce the issue in Chrome stable. E.g.:

    [...'\u{010000}'].length;
    // → Actual: 2
    // → Expected: 1

I cannot reproduce the issue in a recent d8 (which makes sense given comment #1).

Comment 11 by neis@chromium.org, Dec 18

Cc: habl...@google.com
Owner: neis@chromium.org
Status: Fixed (was: Unconfirmed)
As mentioned in comment 1, this bug has been fixed a while ago. The fix should have been merged back to stable but wasn't. Unfortunately it's now too late for that, so we'll have to wait for 72 to become stable next month.

Comment 12 by neis@chromium.org, Dec 20 

 Issue v8:8612  has been merged into this issue.
►

Sign in to add a comment