340369 - Crash on bonsai query page [@ Statement]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Ria Klaassen (not reading all bugmail)]

- Go to http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=PhoenixTinderbox&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=day&mindate=&maxdate=&cvsroot=/cvsroot
- Click on one of the links in the section File
- Result: Firefox crashes

Regression between 1.9a1_2006060313 and 1.9a1_2006060322.
http://bonsai.mozilla.org/cvsquery.cgi?module=PhoenixTinderbox&date=explicit&mindate=2006-06-03+12%3A00&maxdate=2006-06-03+23%3A00


Incident ID: 19508512
Stack Signature	Statement b2b53108
Product ID	FirefoxTrunk
Build ID	2006060404
Trigger Time	2006-06-04 23:44:23.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	js3250.dll + (0003b405)
URL visited	
User Comments	
Since Last Crash	21 sec
Total Uptime	25039 sec
Trigger Reason	Access violation
Source File, Line No.	c:\builds\tinderbox\fx-trunk-cairo\winnt_5.2_depend\mozilla\js\src\jsparse.c, line 2231
Stack Trace 	
Statement   Statements   FunctionBody   js_CompileFunctionBody

Comment 1

[:Gavin Sharp [email: [e-mail]]]

pn is null at:
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/js/src/jsparse.c&rev=3.172&mark=2231#2230

Comment 2

[:Gavin Sharp [email: [e-mail]]]

That js actually has a syntax error. A simple testcase is "javascript:return /;" in the location bar.

Comment 3

[Brendan Eich [:brendan]]

Attachment: trivial fix

Oh for crying out loud.

Apart from this rum-dumb bug, it looks like bonsai generates bad JS -- someone file a separate bug on that?

/be

Comment 4

[:Gavin Sharp [email: [e-mail]]]

(In reply to comment #3)
> Apart from this rum-dumb bug, it looks like bonsai generates bad JS -- someone
> file a separate bug on that?

Filed bug 340408.

Comment 5

[Brendan Eich [:brendan]]

Fixed.

/be

Comment 6

[Bob Clary [:bc] (inactive)]

Checking in regress-340369.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-340369.js,v  <--  regress-340369.js
initial revision: 1.1

Comment 7

[Bob Clary [:bc] (inactive)]

verified fixed 1.9 windows/mac(ppc|tel)/linux 20060810