349610 - javascript generator crashes when comparing with null

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[u130342]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1b1) Gecko/20060710 Firefox/2.0b1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1b1) Gecko/20060710 Firefox/2.0b1

While experimenting with new JS1.7 features I found that firefox crashes when comparing an generator against null.


Reproducible: Always

Steps to Reproduce:
Run this in chrome space (or as single line in error console):
function G()
{
  for(var i=0; i<2; i++)
    yield i;
}

var g=G();
if(g==null)
  alert("never");


Actual Results:  
firefox crashes with NULL pointer exception

Expected Results:  
don't crash, show alert box

Comment 1

[Brendan Eich [:brendan]]

WFM now.  A stack would help identify the bug against which this should be dup'ed.

/be

Comment 2

[u130342]

Attachment: full stack dump

Head of Stack dump, catched from VS8
        00000000()      
        js3250.dll!600f3240()   
        [Frames below may be incorrect and/or missing, no symbols loaded for js3250.dll]        
        msvcrt.dll!77bfc2e3()   
        js3250.dll!60119bf1()   
        msvcrt.dll!77bfc2e3()   
        js3250.dll!600d6327()   
        js3250.dll!600d62ff()   
        js3250.dll!600d6400()   
 
For full stack dump see Attachment.

Comment 3

[Brendan Eich [:brendan]]

Dup of bug 349023 -- or was that not introduced until after 1.8b1?

/be

Comment 4

[timeless]

reporter: please install a mozilla.org talkback enabled release and report  talkback incident id.

Comment 5

[u130342]

Incident ID is TB22461997K.

Maybe talkback should display some message including the ID after sending the data (with option to copy to clipboard). Just as suggestion.

Comment 6

[timeless]

brendan: you didn't specify if that was wfm branch or wfm trunk :(

talkback often takes a long time to send, so a dialog would be unexpected. on modern talkback clients you can use ctrl-c from the window to copy the incident id. if you run talkback.exe before crashing, it won't quit when it finishes sending, so you can easily copy the incident id when it's done :).

http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/js/src/jsinterp.c&mark=3254&rev=MOZILLA_1_8_BRANCH#3254
http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/js/src/jsinterp.c&mark=3254&rev=FIREFOX_2_0b1_RELEASE#3254
  
Incident ID: 22461997
Stack Signature	0x00000000 fd82ebe7
Product ID	Firefox2
Build ID	2006071020
Trigger Time	2006-08-24 09:35:32.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	
URL visited	
User Comments	
Since Last Crash	46 sec
Total Uptime	220 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
0x00000000
js_Interpret  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3254]
js_Execute  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1599]
JS_EvaluateUCScriptForPrincipals  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 4322]
nsJSContext::EvaluateString  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1124]
nsJSThunk::EvaluateScript  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp, line 302]
nsJSChannel::InternalOpen  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp, line 566]
nsJSChannel::AsyncOpen  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp, line 538]
nsURILoader::OpenURI  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/uriloader/base/nsURILoader.cpp, line 917]
nsDocShell::DoChannelLoad  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/docshell/base/nsDocShell.cpp, line 7044]
nsDocShell::DoURILoad  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/docshell/base/nsDocShell.cpp, line 6902]
nsDocShell::InternalLoad  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/docshell/base/nsDocShell.cpp, line 6659]
nsDocShell::LoadURI  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/docshell/base/nsDocShell.cpp, line 830]
nsFrameLoader::LoadFrame  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/content/base/src/nsFrameLoader.cpp, line 189]
nsSubDocumentFrame::ReloadURL  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameFrame.cpp, line 814]
nsCSSFrameConstructor::AttributeChanged  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 10677]
PresShell::AttributeChanged  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5447]
nsXULElement::SetAttrAndNotify  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 1509]
nsXULElement::SetAttr  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 1430]
nsGenericElement::SetAttribute  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 1495]
XPTC_InvokeByIndex  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2160]
XPC_WN_CallMethod  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1450]
js_Invoke  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1349]
js_Interpret  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 4085]
js_Invoke  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1368]
js_InternalInvoke  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1447]
JS_CallFunctionValue  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 4377]
nsJSContext::CallEventHandler  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1474]
nsJSEventListener::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/dom/src/events/nsJSEventListener.cpp, line 195]
nsEventListenerManager::HandleEventSubType  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1655]
nsEventListenerManager::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1762]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2219]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2240]
nsGenericElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 2248]
nsHTMLInputElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/content/html/content/src/nsHTMLInputElement.cpp, line 1507]
PresShell::HandleEventInternal  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6379]
PresShell::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6215]
nsViewManager::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 2514]
nsViewManager::DispatchEvent  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 2246]
HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line 174]
nsWindow::DispatchEvent  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1349]
nsWindow::DispatchKeyEvent  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 3598]
nsWindow::OnKeyDown  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 3745]
nsWindow::ProcessMessage  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 4719]
nsWindow::WindowProc  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1538]
USER32.dll + 0x8734 (0x77d18734)
USER32.dll + 0x8816 (0x77d18816)
USER32.dll + 0x89cd (0x77d189cd)
USER32.dll + 0x8a10 (0x77d18a10)
nsAppShell::Run  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/widget/src/windows/nsAppShell.cpp, line 159]
nsAppStartup::Run  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 152]
main  [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 61]
kernel32.dll + 0x16fd7 (0x7c816fd7)

Comment 7

[u130342]

It's official ff2.0b1, so it's trunk.

Isn't that clear by the build identifier?

The talkback thing... (sorry, probably here's the wrong place to discuss)
I used it the first time and it took me a while to figure out how to get the incident id, well I sent two reports, where one would have been enough.
Isn't there a progress bar already? I don't remember for sure ;-) 
It was saying sending .. then it was gone suddenly. 
I expected to get a final message like "Talkback information has been successfully sent to mozilla.org and can be referrered by incident id XXX. Click Ctrl+C to copy the incident id to clipboard".