352606 - Crash [@ js_GetGCThingFlags] involving post-decrement operator

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

js> y = ({toString: gc}); new Function("y--;")()

Causes a crash [@ js_GetGCThingFlags] at the line 
  offsetInArena = pi->offsetInArena

gdb says
  thing == 0xdadadad8
  pi == (JSGCPageInfo *) 0xdadad800

I can get a similar crash without the "toString: gc" thing if I enable WAY_TOO_MUCH_GC.

Comment 1

[Brendan Eich [:brendan]]

Attachment: fix

This is zero-risk.  The bug originated in the fix for bug 316885 last fall.

/be

Comment 2

[Brendan Eich [:brendan]]

Comment on attachment 238364 [details] [diff] [review]
fix

Going for igor r+ in case mrbkap is busy at school, and since igor reviewed 316885.

/be

Comment 3

[Brendan Eich [:brendan]]

The bug was failure to initialize stack bounded by fp->sp, therefore scanned by the GC -- the vp = sp++ was violating the PUSH macro's tiny level of abstraction. That trick never works!

/be

Comment 4

[Brendan Eich [:brendan]]

Fixed on trunk.

/be

Comment 5

[Bob Clary [:bc] (inactive)]

Attachment: js1_5/GC/regress-352606.js

Comment 6

[Mike Schroepfer]

Comment on attachment 238364 [details] [diff] [review]
fix

a=schrep

Comment 7

[Brendan Eich [:brendan]]

Fixed on the 1.8 branch.

/be

Comment 8

[Bob Clary [:bc] (inactive)]

verified fixed 1.9 20060914 windows/mac*/linux

Comment 9

[Bob Clary [:bc] (inactive)]

verified fixed 1.8 20060915 windows/mac*/linux

Comment 10

[Daniel Veditz [:dveditz]]

Restoring lost blocking flag

Comment 11

[Daniel Veditz [:dveditz]]

Comment on attachment 238364 [details] [diff] [review]
fix

approved for 1.8.0 branch, a=dveditz for drivers

Comment 12

[Brendan Eich [:brendan]]

Fixed on the 1.8.0 branch:

Checking in jsinterp.c;
/cvsroot/mozilla/js/src/jsinterp.c,v  <--  jsinterp.c
new revision: 3.181.2.17.2.21; previous revision: 3.181.2.17.2.20
done

/be

Comment 13

[Brendan Eich [:brendan]]

Attachment: what i checked into the 1.8.0 branch

Comment 14

[Bob Clary [:bc] (inactive)]

verified fixed 1.8.0.8 20060927 windows/mac*/linux

Comment 15

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_5/GC/regress-352606.js,v  <--  regress-352606.js