120725 - On Mac9.1, JS crashing on tests/ecma/TypeConversion/9.4-2.js

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Phil Schwartau]

As recently as a week or so ago, this test passed just fine on my Mac.
Suddenly it is crashing! Only on my Mac; passes fine on WinNT, Linux.

Will research further to isolate the line in the testcase that 
provokes the crash. Patrick took a look at this and found that
memory was being allocated in blocks that overlapped...

Comment 1

[Phil Schwartau]

Here is the path to the test:

           mozilla/js/tests/ecma/TypeConversion/9.4-2.js

Comment 2

[Phil Schwartau]

I have reduced the testcase down to this one line, which crashes my Mac:

                          Date(8.64e15);

With this proviso: this does not crash for me in the interactive shell.
I have to make a test file with this one line in it, save it into the
mozilla:js:tests:ecma:TypeConversion directory, and run the test driver
on it three times in a row. Only on the third time does my Mac crash.

Note: every time one runs the test driver on this test, it will load the 
utility file mozilla:js:tests:ecma:shell.js before loading the testcase.
What my findings indicate is that some sort of random amount of memory 
allocation is taking place by running the driver three times, which
eventually exposes the memory allocation-overlap problem Patrick saw.


Note the recent change to jsnum.c to fix bug 120083, 
"JavaScript toInt32 conversion doesn't match ECMAScript definition"
http://bonsai.mozilla.org/cvslog.cgi?file=mozilla/js/src/jsnum.c

And the recent change to jsdate.c to fix bug 118266, 
"JS Date type mixed with document.cookie considered harmful"
http://bonsai.mozilla.org/cvslog.cgi?file=mozilla/js/src/jsdate.c

Comment 3

[Phil Schwartau]

Never mind the Date() function above; this one line is all I need to crash:

                             8.64e15;


Again, I must save this in a test file, say "TEST.js", save it to the
mozilla:js:tests:ecma:TypeConversion directory, and run the test driver
on it three times in a row. This is the command line I'm using in the
MPW shell (note the space and non-standard 'f' after 'MacPerl'; the -I 
option to Perl simply tells it where your Perl libraries are):


perl -I"Yang:Home:Mozilla tools:MacPerl ƒ:lib" jsDriver.pl -e smdebug
     -f TEST.html -k -l ecma:TypeConversion:TEST.js

Comment 4

[Brant Gurganus]

By the definitions on <http://bugzilla.mozilla.org/bug_status.html#severity> and
<http://bugzilla.mozilla.org/enter_bug.cgi?format=guided>, crashing and dataloss
bugs are of critical or possibly higher severity.  Only changing open bugs to
minimize unnecessary spam.  Keywords to trigger this would be crash, topcrash,
topcrash+, zt4newcrash, dataloss.

Comment 5

[Simon Paquet [:sipaq]]

This bug is targeted at a Mac classic platform/OS, which is no longer supported
by mozilla.org. Please re-target it to another platform/OS if this bug applies
there as well or resolve this bug.

I will resolve this bug as WONTFIX in four weeks if no action has been taken.
To filter this and similar messages out, please filter for "mac_cla_reorg".

Comment 6

[Brendan Eich [:brendan]]

noMoMacOS9 support.

/be