349023 - Bogus JSCLASS_IS_EXTENDED in the generator class

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Pavel Cvrcek [:JasnaPaka]]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1b1) Gecko/20060817 BonEcho/2.0b1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1b1) Gecko/20060817 BonEcho/2.0b1

1. Visit URL (see above).
2. Firefox crashes.

TB22194801G

Reproducible: Always




Same problem with latest Firefox Trunk.

Comment 1

[Pavel Cvrcek [:JasnaPaka]]

Source:

<script type="text/javascript" language="JavaScript">
function test() {
  var i = 0;
  yield i;
}

var g = test();
for (var i = 0; i < 10; i++) {
  document.write(g.next() + "<BR>\n");
}
</script>

Comment 2

[Steve England [:stevee]]

Incident ID: 22194801
Stack Signature	iterator_self 2930a74a
Product ID	Firefox2
Build ID	2006081703
Trigger Time	2006-08-17 09:21:46.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	js3250.dll + (0002aaeb)
URL visited	
User Comments	
Since Last Crash	11738 sec
Total Uptime	11738 sec
Trigger Reason	Access violation
Source File, Line No.	.../mozilla/js/src/jsiter.c, line 278
Stack Trace 	
iterator_self  [.../mozilla/js/src/jsiter.c, line 278]
nsXPConnect::GetWrappedNativeOfJSObject  [.../mozilla/js/src/xpconnect/src/nsXPConnect.cpp, line 677]
nsWindowSH::GetProperty  [.../mozilla/dom/src/base/nsDOMClassInfo.cpp, line 4194]
XPC_WN_Helper_GetProperty  [.../mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 947]
js_Interpret  [.../mozilla/js/src/jsinterp.c, line 4178]
js_Execute  [.../mozilla/js/src/jsinterp.c, line 1600]
JS_EvaluateUCScriptForPrincipals  [.../mozilla/js/src/jsapi.c, line 4365]
nsJSContext::EvaluateString  [.../mozilla/dom/src/base/nsJSEnvironment.cpp, line 1098]
nsScriptLoader::EvaluateScript  [.../mozilla/content/base/src/nsScriptLoader.cpp, line 775]
nsScriptLoader::ProcessRequest  [.../mozilla/content/base/src/nsScriptLoader.cpp, line 673]
nsScriptLoader::DoProcessScriptElement  [.../mozilla/content/base/src/nsScriptLoader.cpp, line 606]
nsScriptLoader::ProcessScriptElement  [.../mozilla/content/base/src/nsScriptLoader.cpp, line 358]
nsHTMLScriptElement::MaybeProcessScript  [.../mozilla/content/html/content/src/nsHTMLScriptElement.cpp, line 663]
nsHTMLScriptElement::BindToTree  [.../mozilla/content/html/content/src/nsHTMLScriptElement.cpp, line 456]
nsGenericElement::AppendChildTo  [.../mozilla/content/base/src/nsGenericElement.cpp, line 2868]
HTMLContentSink::ProcessSCRIPTTag  [.../mozilla/content/html/document/src/nsHTMLContentSink.cpp, line 4174]
HTMLContentSink::AddLeaf  [.../mozilla/content/html/document/src/nsHTMLContentSink.cpp, line 3040]
HTMLContentSink::AddHeadContent  [.../mozilla/content/html/document/src/nsHTMLContentSink.cpp, line 2991]
CNavDTD::AddHeadLeaf  [.../mozilla/parser/htmlparser/src/CNavDTD.cpp, line 3613]
CNavDTD::HandleToken  [.../mozilla/parser/htmlparser/src/CNavDTD.cpp, line 955]
CNavDTD::BuildModel  [.../mozilla/parser/htmlparser/src/CNavDTD.cpp, line 458]
nsParser::BuildModel  [.../mozilla/parser/htmlparser/src/nsParser.cpp, line 2145]

Comment 3

[Brendan Eich [:brendan]]

The stack makes no sense:

iterator_self  [.../mozilla/js/src/jsiter.c, line 278]
nsXPConnect::GetWrappedNativeOfJSObject 

There's no direct or indirect call that can connect those two frames.  Even if intervening frames were optimized away.

Anyway, the test URL works for me on trunk now, and the 1.8 branch files to-do with iterators and generators are in sync.  If someone can find the bug that fixed this, mark it a dup.  I'm marking WFM.

/be

Comment 4

[Mike Schroepfer]

clearing blocking flag

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

(In reply to comment #3)
> The stack makes no sense:
> 
> iterator_self  [.../mozilla/js/src/jsiter.c, line 278]
> nsXPConnect::GetWrappedNativeOfJSObject 

The calling line in nsXPConnect::GetWrappedNativeOfJSObject is NS_ADDREF(wrapper), a virtual call, so if wrapper is a deleted object, then this does make sense. I think that this might be worth keeping open to investigate how nsXPConnect::GetWrappedNativeOfJSObject can return a dead wrapper.

Comment 6

[Stephen Donner [:stephend] Not actively reading bugmail]

Attachment: TB22207950G

I actually crash in JS_GetClass using trunk SeaMonkey 2006-08-17-08; oddly enough, I don't crash in today's trunk Minefield build, it just displays a "0."

Comment 7

[Pavel Cvrcek [:JasnaPaka]]

With today FF Branch: TB22233844M

Comment 8

[Jesse Ruderman]

*** Bug 349281 has been marked as a duplicate of this bug. ***

Comment 9

[Jesse Ruderman]

Attachment: Jesse's testcase

Comment 10

[Jesse Ruderman]

Stack trace with a few-days-old build: http://pastebin.mozilla.org/82

Stack trace with a few-minutes-old build: http://pastebin.mozilla.org/83

Comment 11

[Igor Bukanov]

Here is a trivial example for JS shell that crashes immediately:

gen = (function() { yield 3; })();
var x = (gen ==gen);

When changing generators back to use JSClass in bug 346450 I forgot to remove JSCLASS_IS_EXTENDED :(

Comment 12

[Igor Bukanov]

Attachment: Fix

Comment 13

[Brendan Eich [:brendan]]

This could go in for beta 2.

/be

Comment 14

[Brendan Eich [:brendan]]

Comment on attachment 234560 [details] [diff] [review]
Fix

How'd I miss that?  Sigh.

/be

Comment 15

[Igor Bukanov]

I committed the patch from comment 12.

Comment 16

[Martijn Wargers (dead)]

*** Bug 349346 has been marked as a duplicate of this bug. ***

Comment 17

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 234560 [details] [diff] [review]
Fix

a=beltzner on behalf of drivers, mrbkap to land through the haze of some jager ...

Comment 18

[(not reading, please use [e-mail] instead)]

I've just landed the fix to the 1.8 branch

Comment 19

[Bob Clary [:bc] (inactive)]

RCS file: /cvsroot/mozilla/js/tests/js1_7/geniter/regress-349023-01.js,v
done
Checking in regress-349023-01.js;
/cvsroot/mozilla/js/tests/js1_7/geniter/regress-349023-01.js,v  <--  regress-349023-01.js
initial revision: 1.1
done
RCS file: /cvsroot/mozilla/js/tests/js1_7/geniter/regress-349023-02.js,v
done
Checking in regress-349023-02.js;
/cvsroot/mozilla/js/tests/js1_7/geniter/regress-349023-02.js,v  <--  regress-349023-02.js
initial revision: 1.1
done
RCS file: /cvsroot/mozilla/js/tests/js1_7/geniter/regress-349023-03.js,v
done
Checking in regress-349023-03.js;
/cvsroot/mozilla/js/tests/js1_7/geniter/regress-349023-03.js,v  <--  regress-349023-03.js
initial revision: 1.1
done

Comment 20

[Bob Clary [:bc] (inactive)]

verified fixed 1.8, 1.9 20060821 windows/mac*/linux