295116 - variable pn2->pn_slot can be read while uninitialised

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Ferdinand]

I ran firefox through valgrind, and I saw a lot of these come up:

==5433== Conditional jump or move depends on uninitialised value(s)
==5433==    at 0x1BCBDA22: js_EmitTree (jsemit.c:4081)
==5433==    by 0x1BCBD044: js_EmitTree (jsemit.c:3891)
==5433==    by 0x1BCBA568: js_EmitTree (jsemit.c:3009)
==5433==    by 0x1BD0DA74: Statements (jsparse.c:1056)
==5433==    by 0x1BD0C85A: FunctionBody (jsparse.c:656)

The traces varied slightly, but just running firefox in gdb with a
break at jsemit.c:4081 with display pn2->pn_u.name.slot will show
some interesting values (some of the time). It only seems to happen
at this particular if. CC'ing Brendan based on lxr blame.

Comment 1

[Brendan Eich [:brendan]]

Regression introduced by fix for bug 155081.

/be

Comment 2

[Brendan Eich [:brendan]]

Attachment: fix

cvs diff -r3.1{09,10} jsemit.c and look for DOT: to see the regression.  I will
check this in soon, with imputed r=shaver.

/be

Comment 3

[Brendan Eich [:brendan]]

Ferdinand, thanks very much for catching this.

/be

Comment 4

[Brendan Eich [:brendan]]

Fixed.

/be

Comment 5

[Mike Shaver (:shaver emeritus)]

Comment on attachment 184254 [details] [diff] [review]
fix

r=shaver