263139 - crash - js tests javascript1.2 on ecma/Number/15.7.4.js

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Bob Clary [:bc] (inactive)]

1. visit online js tests
2. choose javascript1.2
3. select ecma suite tests.
4. execute test list.
5. crash when ecma/Number/15.7.4.js executes.

Note running by itself does not crash. I've seen at least two different stacks
on this.

Comment 1

[Brendan Eich [:brendan]]

I don't see a crash here, and I've been running the testsuite lately, on trunk
and branch, with and without e4x.  Hmm, I haven't run branch as recently as
trunk. Are you running on the trunk?

/be

Comment 2

[Bob Clary [:bc] (inactive)]

crash on sm branch 1.7, trunk from yesterday and on ff branch from yesterday.
Note this is using the online version for the ecma suite and you must select the
javascript1.2 language and run the full ecma suite to see the crash.

Comment 3

[Brendan Eich [:brendan]]

Are you waiting for TBs to get processed, or do you have stacks?

/be

Comment 4

[Nicholas Allen]

I can do this crash with a FF trunk build from 10/01.  I'll run it on some
builds with symbols if you need stacks but it takes a while to reproduce.

Comment 5

[Bob Clary [:bc] (inactive)]

i have tbs waiting but can give you stacks. I started to give one last evening
but when reproducing it I got a different one and decided to let you get your
own. But you can also see an earlier one at
<http://bclary.com/2004/10/03/js-tests-results/moz18-no-js5-js12.crash>

Comment 6

[Bob Clary [:bc] (inactive)]

Attachment: stack 1 - seems most common

Comment 7

[Brendan Eich [:brendan]]

Crap, I don't see that crash in the JS shell.  Can someone run valgrind or purify?

/be

Comment 8

[Bob Clary [:bc] (inactive)]

the JS shell is sane and will not execute the ecma suite with version 120. The
online version allows you to do crazy things like run any suite with any
language version. Maybe if you hack a local copy to force the ecma suite to run
with version 120 you can reproduce it. Are valgrind or purify free or commercial?

Comment 9

[David Bradley]

FYI: Valgrind is free but Linux only, Purify is commercial but runs on several 
platforms.

I can give Purify a try this evening if someone doesn't beat me to it.

Comment 10

[Brendan Eich [:brendan]]

bc: the JS testsuite was written for the shell, and the js shell supports a
version() function taking a number (120 for 1.2, e.g.) by which the suite or any
user can set the language version, so the suite does actually test the 1.2 code
paths.  Those paths are few, but they do affect such things as whether toString
is really toSource (in 1.2, it is).

Busy today, I'll have more time for this and other bugs tomorrow.

/be

Comment 11

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a5) Gecko/20041007

no need to run the full suite, just the neighboring tests are sufficient to
trigger the crash. DocWatson comes up, Talkback is sleeping.

Steps to repeat, direct link to the tests:
1. http://bclary.com/2004/10/03/js-tests/menu.html#TESTDIR_ecmaObjectObjects
2. select      15.2.1.1.js Object( value )
3. scroll UP for the preceding tests
4. select      15.7.4.3-3-n.js 
               15.7.4.js Properties of the Number Prototype Object
6. use link 'Top of ecma Suite'
7. use link 'Top of page'
8. select  Language Version Javascript 1.2
9. Execute Test List
10. enjoy crash

Comment 12

[Bob Clary [:bc] (inactive)]

Thanks Hermann. OBTW, crashes on SuSe 9.1 with a trunk build from 20040926

Comment 13

[Hermann Schwab]

TB1182271Q 
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB1182271Q

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.4) Gecko/20040925

Regression is old, didn´t find a working Build yet:
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7b) Gecko/20040411
BuildID 20041708, 2004052009, 2004080309, 2004082508, 2004091804 all crashing.

as Talkback triggered on the 1.7.4 build, it seems talkback has issues in the trunk.

Comment 14

[Hermann Schwab]

TB1182609W
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a5) Gecko/20041007
got talkback working by deleting compreg.dat

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB1182609W

both talkbacks (1.7.4, 1.8a5) are showing the same stack signature 	
JS_HashTableDestroy 8e5380b9 

Comment 15

[Hermann Schwab]

I don´t think that this is an regression, as 1.6 and 1.4.2 are also crashing.
Versions of Mozilla.exe, WindowsExplorer->Properties->Version:
1.4.2: 2004042614
1.6: 2004011308

Comment 16

[Hermann Schwab]

TB1183421Q
Mozilla/5.0 (Windows; U; Win98; rv:1.7.3) Gecko/20041006 Firefox/0.10.1

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB1183421Q

JS_HashTableDestroy 8e5380b9

Comment 17

[Hermann Schwab]

It is a regression, Mozilla 1.2a working, 1.2b crashing. There are no nightlies
for this at archive.mozilla.org, as it starts end of 2002.

1.0.1, 1.0.2, 1.1, 1.2a BuildID 2002091014 tested on Win98SE working,
1.2  BuildID 20021126 tested on Win98SE crashing.

working: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.2a) Gecko/20020910

Talkbacks sent to Netscape:
TB33963669Y Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.2b) Gecko/20021016 
TB33963466Z Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.2) Gecko/20021126 




14 crashes with stack signature js_hashtabledestroy 8e5380b9
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=+JS_HashTableDestroy+8e5380b9&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=

Comment 18

[Erik Fabert]

Following the steps in comment 11, a build from 20041123 crashes, a build from 
20041125 does not. Maybe this was fixed by the checkin for bug 271477?

Comment 19

[Bob Clary [:bc] (inactive)]

I can confirm no crash in trunk seamonkey from 12/14 and still a crash in 1.7.5
from 12/14. Perhaps the fix in bug 271477 can go on the 1.7 branch as well.
Moving bug to branch only.

Comment 20

[Bob Clary [:bc] (inactive)]

wfm with recent Mozilla 1.7.6 build.