iOS: invalid casting on String.format crashes whole app

[Informate]

I have searched and made sure there are no existing issues for the issue I am filing

• I have searched the existing issues

Description

String.format on iOS does not perform a casting conversion and in case you enter a number instead of a string the app crashes inexplicably (for those trying to debug the code).
Example:

String.format(“Test %s”,2)

The logs report a segmentation fault:

[ERROR] Application received error: signal error code: 11
[ERROR] (null)
5900 Segmentation fault: 11

Xcode debugger reports:

EXC_BAD_ACCESS (code=1, address=0x3ff00000000000)

Xcode execution stack indicates:

libobjc.A.dylib`objc_opt_respondsToSelector
Foundation`:_NSDescriptionWithStringProxyFunction
CoreFoundation`: __CFStringAppendFormatCore
CoreFoundation`:__CFStringCreateWithFormatAndArgumentsReturningMetadata
TitaniumKit`StringFormatCallback
JavaScriptCore`JSC::callJSCallbackFunction
JavaScriptCore`llint_entry:

FIXING WORKAROUND:
Always cast to string function parameters and use %s in the format string:

String.format(“Test %s”,''+2)

Expected Behavior

Correct casting conversion, or at least throw an exception. Do not crashes the app

Actual behavior

Creashes the whole app

Reproducible sample

String.format(“Test %s”,2)

Steps to reproduce

String.format(“Test %s”,2)

Platform

iOS

SDK version you are using

12.4.0

Alloy version you are using

No response

[hbugdoll]

The call String.format("Test %s", 2) results in StringFormatCallback()

titanium-sdk/iphone/TitaniumKit/TitaniumKit/Sources/Kroll/KrollContext.m

Lines 188 to 189 in d34cb78

	static JSValueRef StringFormatCallback(JSContextRef jsContext, JSObjectRef jsFunction, JSObjectRef jsThis, size_t argCount,
	const JSValueRef args[], JSValueRef *exception)

to [NSString stringWithFormat:@"Test %@", 2] which crashes
Unlike Java, Objective-C doesn't have autoboxing on primitive types.

Perhaps using the boxing operator @( ) in

titanium-sdk/iphone/TitaniumKit/TitaniumKit/Sources/Kroll/KrollContext.m

Line 235 in d34cb78

[result appendString:[NSString stringWithFormat:theFormat, theResult]];

and (same for bools, String.format("Test %s", true) also crashed)

titanium-sdk/iphone/TitaniumKit/TitaniumKit/Sources/Kroll/KrollContext.m

Line 238 in d34cb78

[result appendString:[NSString stringWithFormat:theFormat, theResult]];

would solve the problem.

[Informate]

The call String.format("Test %s", 2) results in StringFormatCallback()

titanium-sdk/iphone/TitaniumKit/TitaniumKit/Sources/Kroll/KrollContext.m

Lines 188 to 189 in d34cb78
static JSValueRef StringFormatCallback(JSContextRef jsContext, JSObjectRef jsFunction, JSObjectRef jsThis, size_t argCount,
const JSValueRef args[], JSValueRef *exception)

to [NSString stringWithFormat:@"Test %@", 2] which crashes
Unlike Java, Objective-C doesn't have autoboxing on primitive types.

Perhaps using the boxing operator @( ) in

titanium-sdk/iphone/TitaniumKit/TitaniumKit/Sources/Kroll/KrollContext.m

Line 235 in d34cb78
[result appendString:[NSString stringWithFormat:theFormat, theResult]];

and (same for bools, String.format("Test %s", true) also crashed)

titanium-sdk/iphone/TitaniumKit/TitaniumKit/Sources/Kroll/KrollContext.m

Line 238 in d34cb78
[result appendString:[NSString stringWithFormat:theFormat, theResult]];

would solve the problem.

Maybe it would be better to previously convert the refValue to a String and then append it as a %s indipendently of the %i, %p %q, or what else.
Very interesting that you detected the code segment relevant for the issue!!! Thanks for that!!!

[hbugdoll]

Maybe it would be better to previously convert the refValue to a String and then append it as a %s
indipendently of the %i, %p %q, or what else.

I don't think so. For example, you would lose the formatting options for numbers:

[NSString stringWithFormat:@"Test %.2f", 3.1415926535] → "Test 3.14" vs.
[NSString stringWithFormat:@"Test %s", "3.1415926535"] → "Test 3.1415926535"

---

The task should be to achieve parity with Android.
I quickly tried it out – Java does not allow all combinations of data types and formatting options

	%s	%b	%d	%f
String	X	X
boolean	X	X
int	X	X	X
long	X	X	X
float	X	X		X
double	X	X		X

in its String.format() which is called from Titanium's String.format():

titanium-sdk/android/titanium/src/java/ti/modules/titanium/TitaniumModule.java

Lines 250 to 251 in f53606c

	@Kroll.topLevel("String.format")
	public String stringFormat(String format, Object[] args)

The app should therefore never crash under iOS when the formatting characters %s or %b are used.

[Informate]

Your conclusion confuses me alot.
Anyway, do you have any suggestion or code snippet to fix the issue?

Maybe it would be better to previously convert the refValue to a String and then append it as a %s
indipendently of the %i, %p %q, or what else.

I don't think so. For example, you would lose the formatting options for numbers:

[NSString stringWithFormat:@"Test %.2f", 3.1415926535] → "Test 3.14" vs. [NSString stringWithFormat:@"Test %s", "3.1415926535"] → "Test 3.1415926535"

The task should be to achieve parity with Android. I quickly tried it out – Java does not allow all combinations of data types and formatting options
%s %b %d %f
String X X
boolean X X
int X X X
long X X X
float X X X
double X X X

in its String.format() which is called from Titanium's String.format():

titanium-sdk/android/titanium/src/java/ti/modules/titanium/TitaniumModule.java

Lines 250 to 251 in f53606c
@Kroll.topLevel("String.format")
public String stringFormat(String format, Object[] args)

The app should therefore never crash under iOS when the formatting characters %s or %b are used.

[Informate]

I suppose that the fixage could be that in this chunk of code:

if (JSValueIsNumber(jsContext, valueRef)) {
        double theResult = JSValueToNumber(jsContext, valueRef, NULL);
        [result appendString:[NSString stringWithFormat:theFormat, theResult]];

If :theFormat is %s it has to be overwritten to %f or an IllegalArgumentException has to be thrown..

And the same in other failing cases, as the function do not handle correctly misalligned data types.

PS: if the format do not matches the %f template (i.e. %.2f [ends with f]) it has to be overwritten to %f (in this case where a double is passed ) or an IllegalArgumentException has to be thrown. You could now try to ChatGPT the solution ;-)

FIXAGE by ChatGPT:

if (JSValueIsNumber(jsContext, valueRef)) {
 double theResult = JSValueToNumber(jsContext, valueRef, NULL);

 // Validate format
 if (![theFormat hasSuffix:@"f"]) {
   theFormat = @"%f";
 }

 [result appendString:[NSString stringWithFormat:theFormat, theResult]];
}

or (failing)

if (JSValueIsNumber(jsContext, valueRef)) {
 double theResult = JSValueToNumber(jsContext, valueRef, NULL);

 // Validate format
 if (![theFormat hasSuffix:@"f"]) {
  @throw [NSException exceptionWithName:NSInvalidArgumentException
     reason:[NSString stringWithFormat:@"Invalid format '%@' for double", theFormat]
     userInfo:nil];
 }

 [result appendString:[NSString stringWithFormat:theFormat, theResult]];
}