Closed Bug 331787 Opened 15 years ago Closed 15 years ago

FunctionDef should root fun->obj across call to js_LookupHiddenProperty

Categories

(Core :: JavaScript Engine, defect, P1)

defect

Tracking

()

VERIFIED FIXED
mozilla1.9alpha1

People

(Reporter: dbaron, Assigned: brendan)

References

()

Details

(Keywords: fixed1.8.1, verified1.8.0.4)

Attachments

(1 file, 1 obsolete file)

I crash during compilation with WAY_TOO_MUCH_GC in http://lxr.mozilla.org/mozilla/source/js/tests/js1_5/Regress/regress-310607.js
because FunctionDef doesn't root fun->obj across the call to js_LookupHiddenProperty:
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/js/src/jsparse.c&rev=3.163&mark=892,914#892

This can cause deallocation at:
js_GC (/home/dbaron/builds/trunk/mozilla/js/src/jsgc.c:2148)
js_NewGCThing (/home/dbaron/builds/trunk/mozilla/js/src/jsgc.c:668)
js_NewObject (/home/dbaron/builds/trunk/mozilla/js/src/jsobj.c:2021)
fun_resolve (/home/dbaron/builds/trunk/mozilla/js/src/jsfun.c:1119)
js_LookupPropertyWithFlags (/home/dbaron/builds/trunk/mozilla/js/src/jsobj.c:2780)
js_LookupHiddenProperty (/home/dbaron/builds/trunk/mozilla/js/src/jsobj.c:2435)
FunctionDef (/home/dbaron/builds/trunk/mozilla/js/src/jsparse.c:914)
Attached patch fix (obsolete) — Splinter Review
Blake, can you drive this fix in?  I'm empaneled through Wednesday at least.  Thanks,

/be
Attachment #216352 - Flags: review?(mrbkap)
Attachment #216352 - Flags: approval1.8.0.3?
Attachment #216352 - Flags: approval-branch-1.8.1+
mrbkap says r=him.

/be
Assignee: general → brendan
Attachment #216352 - Attachment is obsolete: true
Status: NEW → ASSIGNED
Attachment #216805 - Flags: review+
Attachment #216352 - Flags: review?(mrbkap)
Attachment #216352 - Flags: approval1.8.0.3?
Blocks: js1.6rc1
Flags: blocking1.8.1+
Flags: blocking1.8.0.3?
OS: Linux → All
Priority: -- → P1
Hardware: PC → All
Target Milestone: --- → mozilla1.9alpha
Attachment #216805 - Flags: approval1.8.0.3?
Attachment #216805 - Flags: approval-branch-1.8.1+
Fixed on trunk and 1.8 branch.

/be
Status: ASSIGNED → RESOLVED
Closed: 15 years ago
Keywords: fixed1.8.1
Resolution: --- → FIXED
Flags: blocking1.8.0.3? → blocking1.8.0.3+
Dan, were you going to approve the patch too?

/be
Comment on attachment 216805 [details] [diff] [review]
with comment moved

approved for 1.8.0 branch, a=dveditz for drivers
Attachment #216805 - Flags: approval1.8.0.3? → approval1.8.0.3+
Fixed on the 1.8.0 branch.

/be
Keywords: fixed1.8.0.3
1.5.0.4 WAY_TOO_MUCH_GC

windows debug: browser known crash in js_HashString, shell no crash
linux   debug: browser now crash, shell no crash
Flags: in-testsuite+
verified fixed 1.9 20060807 linux
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.