616711 - Crash [@ js_SuppressDeletedProperty] or [@ JSObject::getPrivate]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: console output

this.toString = String
try {
    (function () {
        for each(d in evalcx("({n:<x/>})")) {
            #1#
        }
    })()
} catch (r) {}
gc()
delete this.toString

crashes js debug shell on TM changeset d31f58102b38 at JSObject::getPrivate and crashes js opt shell at js_SuppressDeletedProperty.

s-s because this involves gc. 0xdadadada also seems to be accessed, albeit in debug builds. Assuming [sg:critical?] unless otherwise.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The testcase has to be passed in as a CLI argument.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   57084:f52f5d7feb29
user:        Andreas Gal
date:        Wed Nov 10 15:56:00 2010 -0800
summary:     typeof(regexp from sandbox) is "function" (bug 607799, r=brendan).

Comment 3

[Andreas Gal :gal]

bisect is a red herring

Comment 4

[Andreas Gal :gal]

GC bug, must block

Comment 5

[Brian Hackett [Laid off!]]

Attachment: maybe fix

The problem seems to be that Reify in jswrapper.cpp does not close the active iterator on its failure paths.  This can leave cx->enumerators pointing to an iterObj with no other referent, and since cx->enumerators is not traversed by the GC (it is only supposed to point to things on the stack) the iterObj gets collected.  Reify should always close the old iterator (it does so on successful paths), as this patch does.  I don't really know the proxy/wrapper code though, is this the right interpretation?

Comment 6

[Andreas Gal :gal]

Comment on attachment 497420 [details] [diff] [review]
maybe fix

An Auto helper might be worth it here. Nice catch. Thanks for fixing this!

Comment 7

[Brian Hackett [Laid off!]]

Yeah, the helper does look cleaner.

http://hg.mozilla.org/tracemonkey/rev/b013a27e6275

Comment 8

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/b013a27e6275

Comment 9

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.