301545 - [E4X] crash when attribute-op name collides with local var

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Axel Hecht]

Using the E4X attribute syntax, I get a crash.

function TOCParser(aElement) {
  var href = aElement.@href;
}

crashes on parsing, the same code with @href2 is fine. Sample js and stacktrace
coming up.

Just 
./run-mozilla.sh ./xpcshell -x -f /tmp/e4x-crash.js
does the trick for me, CVS build from yesterday.

Comment 1

[Axel Hecht]

Attachment: js file that crashes, text/plain so that you can actually look.

Comment 2

[Axel Hecht]

Attachment: stacktrace

Stack trace. The offending part is a 

default: JS_ASSERT(0);

in LookupArgOrVar, the 

getter == js_GetLocalVariable || getter == js_GetCallVariable

part.

Comment 3

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Updating summary a bit; I'm working this now.

Comment 4

[Axel Hecht]

Worked around the first crasher successfully, now the following line in my code
bails at the same place:

var linkURI = gIOS.newURI(linkNode.@toc, null, this.mPluginURI);

Comment 5

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Attachment: early out from LookupArgOrVar for QNAMEPART

I'm not sure if we need to do JSOP_QNAMECONST here as well, I'm not yet E4Xy
enough to be confident in how to trigger its generation.  I'll look at that
more today, if Brendan can't just jump in and say!

Comment 6

[Brendan Eich [:brendan]]

Comment on attachment 190012 [details] [diff] [review]
early out from LookupArgOrVar for QNAMEPART

Great, thanks!

/be

Comment 7

[Brendan Eich [:brendan]]

Not to worry about JSOP_QNAMECONST -- it's pn_op only in a node whose pn_type is
TOK_DBLCOLON and pn_arity is PN_NAME.  See QualifiedSuffix in jsparse.c.

/be

Comment 8

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Fixed.

Comment 9

[Axel Hecht]

verified, my CVS build eats dogfood nicely now.

Comment 10

[Bob Clary [:bc] (inactive)]

Checking in regress-301545.js;
/cvsroot/mozilla/js/tests/e4x/Expressions/regress-301545.js,v  <-- 
regress-301545.js
initial revision: 1.1

I couldn't get this to crash on Windows. I would appreciate a Linux friend to
pull by date and check that this testcase really does crash.