Last Comment Bug 352606 - Crash [@ js_GetGCThingFlags] involving post-decrement operator
: Crash [@ js_GetGCThingFlags] involving post-decrement operator
Status: VERIFIED FIXED
[sg:critical?]
: crash, testcase, verified1.8.0.8, verified1.8.1
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: All All
: P1 critical (vote)
: mozilla1.8.1
Assigned To: Brendan Eich [:brendan]
:
:
Mentors:
Depends on:
Blocks: jsfunfuzz
  Show dependency treegraph
 
Reported: 2006-09-13 19:32 PDT by Jesse Ruderman
Modified: 2011-06-13 10:01 PDT (History)
4 users (show)
dveditz: blocking1.8.0.8+
bob: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
fix (981 bytes, patch)
2006-09-13 21:58 PDT, Brendan Eich [:brendan]
mrbkap: review+
igor: review+
dveditz: approval1.8.0.8+
mtschrep: approval1.8.1+
Details | Diff | Splinter Review
js1_5/GC/regress-352606.js (2.30 KB, text/plain)
2006-09-14 04:43 PDT, Bob Clary [:bc:]
no flags Details
what i checked into the 1.8.0 branch (2.19 KB, patch)
2006-09-26 16:05 PDT, Brendan Eich [:brendan]
no flags Details | Diff | Splinter Review

Description Jesse Ruderman 2006-09-13 19:32:11 PDT
js> y = ({toString: gc}); new Function("y--;")()

Causes a crash [@ js_GetGCThingFlags] at the line 
  offsetInArena = pi->offsetInArena

gdb says
  thing == 0xdadadad8
  pi == (JSGCPageInfo *) 0xdadad800

I can get a similar crash without the "toString: gc" thing if I enable WAY_TOO_MUCH_GC.
Comment 1 Brendan Eich [:brendan] 2006-09-13 21:58:20 PDT
Created attachment 238364 [details] [diff] [review]
fix

This is zero-risk.  The bug originated in the fix for bug 316885 last fall.

/be
Comment 2 Brendan Eich [:brendan] 2006-09-13 22:01:05 PDT
Comment on attachment 238364 [details] [diff] [review]
fix

Going for igor r+ in case mrbkap is busy at school, and since igor reviewed 316885.

/be
Comment 3 Brendan Eich [:brendan] 2006-09-13 22:03:41 PDT
The bug was failure to initialize stack bounded by fp->sp, therefore scanned by the GC -- the vp = sp++ was violating the PUSH macro's tiny level of abstraction. That trick never works!

/be
Comment 4 Brendan Eich [:brendan] 2006-09-13 23:19:02 PDT
Fixed on trunk.

/be
Comment 5 Bob Clary [:bc:] 2006-09-14 04:43:45 PDT
Created attachment 238405 [details]
js1_5/GC/regress-352606.js
Comment 6 Mike Schroepfer 2006-09-14 11:06:07 PDT
Comment on attachment 238364 [details] [diff] [review]
fix

a=schrep
Comment 7 Brendan Eich [:brendan] 2006-09-14 11:31:25 PDT
Fixed on the 1.8 branch.

/be
Comment 8 Bob Clary [:bc:] 2006-09-14 14:52:32 PDT
verified fixed 1.9 20060914 windows/mac*/linux
Comment 9 Bob Clary [:bc:] 2006-09-16 20:15:32 PDT
verified fixed 1.8 20060915 windows/mac*/linux
Comment 10 Daniel Veditz [:dveditz] 2006-09-19 15:57:00 PDT
Restoring lost blocking flag
Comment 11 Daniel Veditz [:dveditz] 2006-09-26 14:49:12 PDT
Comment on attachment 238364 [details] [diff] [review]
fix

approved for 1.8.0 branch, a=dveditz for drivers
Comment 12 Brendan Eich [:brendan] 2006-09-26 16:02:47 PDT
Fixed on the 1.8.0 branch:

Checking in jsinterp.c;
/cvsroot/mozilla/js/src/jsinterp.c,v  <--  jsinterp.c
new revision: 3.181.2.17.2.21; previous revision: 3.181.2.17.2.20
done

/be
Comment 13 Brendan Eich [:brendan] 2006-09-26 16:05:11 PDT
Created attachment 240224 [details] [diff] [review]
what i checked into the 1.8.0 branch
Comment 14 Bob Clary [:bc:] 2006-09-27 12:39:35 PDT
verified fixed 1.8.0.8 20060927 windows/mac*/linux
Comment 15 Bob Clary [:bc:] 2007-02-08 22:18:18 PST
/cvsroot/mozilla/js/tests/js1_5/GC/regress-352606.js,v  <--  regress-352606.js

Note You need to log in before you can comment on or make changes to this bug.