271718 - another crash on infinite loop creating new arrays [@ js_NewObject]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect, P2)

Description

[Christian :Biesinger (don't email me, ping me on IRC)]

testcase is still attachment 167017 [details]

loading that file now crashed in a different location

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1081527136 (LWP 4420)]
0x401e592d in js_NewObject (cx=0x8623940, clasp=0x4022cfa0, proto=0xbe89538,
parent=0x83e5b30)
    at /home/chb/mozilla/js/src/jsobj.c:1798
1798        if (proto &&
Current language:  auto; currently c

#0  0x401e592d in js_NewObject (cx=0x8623940, clasp=0x4022cfa0, proto=0xbe89538,
parent=0x83e5b30)
    at /home/chb/mozilla/js/src/jsobj.c:1798
#1  0x401cdef3 in js_Interpret (cx=0x8623940, result=0xbfffd600) at
/home/chb/mozilla/js/src/jsinterp.c:3178
[...]
1798        if (proto &&
1799            (map = proto->map)->ops == ops &&

(gdb) print *proto
$1 = {map = 0x0, slots = 0x0}

Comment 1

[Christian :Biesinger (don't email me, ping me on IRC)]

Attachment: stacktrace

Comment 2

[Christian :Biesinger (don't email me, ping me on IRC)]

Attachment: stacktrace with local vars

Comment 3

[Brendan Eich [:brendan]]

Marking dependency on bug containing the testcase.  This may be a separate bug,
or another symptom of the same bug (in which case, DUP).

/be

Comment 4

[Bob Clary [:bc] (inactive)]

Attachment: stacktrace from testcase js1_5/Regress/regress-271716-n.js

seamonkey 1.8 winxpsp2 stack running js1_5/Regress/regress-271716-n.js online.
Note does not crash a trunk smopt js shell from yesterday with or without -S
512888.

Comment 5

[Bob Clary [:bc] (inactive)]

Attachment: stacktrace from attachment attachment 167017

This stacktrace is from loading attachment 167017 [details]. It appears after interacting
with the chrome and appears to be related to lack of OOM handling in XBL.

Comment 6

[Christian :Biesinger (don't email me, ping me on IRC)]

Hm... I seem to be unable to crash now with:
checkout finish: Don Mär 3 01:38:48 CET 2005
linux, seamonkey, gtk2/xft

fixed by bug 271716?

Comment 7

[Christian :Biesinger (don't email me, ping me on IRC)]

Attachment: stack from regress-271716-n.js

I crashed now at #0  0x00cbce6b in js_GetGCThingFlags (thing=0xdadadad8)
with bc's testcase...

Comment 8

[Bob Clary [:bc] (inactive)]

Should we mark this as a dupe of bug 271716 and open a new bug on the crash
during out of memory reporting or morph this bug?

Comment 9

[:Gavin Sharp [email: [e-mail]]]

*** Bug 300234 has been marked as a duplicate of this bug. ***

Comment 10

[Brendan Eich [:brendan]]

Taking.

/be

Comment 11

[Brendan Eich [:brendan]]

Bob, does this still reproduce?

/be

Comment 12

[Bob Clary [:bc] (inactive)]

works for me on 1.8*,1.9 all platforms. only reproducible on 1.7*. I'll review bugs with testcases for others to mark as wfm.