The default bug view has changed. See this FAQ.

Crash [@ js_GetGCThingFlags] involving post-decrement operator

VERIFIED FIXED in mozilla1.8.1

Status

()

Core
JavaScript Engine
P1
critical
VERIFIED FIXED
11 years ago
6 years ago

People

(Reporter: Jesse Ruderman, Assigned: brendan)

Tracking

(Blocks: 1 bug, 4 keywords)

Trunk
mozilla1.8.1
crash, testcase, verified1.8.0.8, verified1.8.1
Points:
---
Bug Flags:
blocking1.8.0.8 +
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [sg:critical?], crash signature)

Attachments

(3 attachments)

(Reporter)

Description

11 years ago
js> y = ({toString: gc}); new Function("y--;")()

Causes a crash [@ js_GetGCThingFlags] at the line 
  offsetInArena = pi->offsetInArena

gdb says
  thing == 0xdadadad8
  pi == (JSGCPageInfo *) 0xdadad800

I can get a similar crash without the "toString: gc" thing if I enable WAY_TOO_MUCH_GC.
(Assignee)

Updated

11 years ago
Assignee: general → brendan
OS: Mac OS X 10.4 → All
Priority: -- → P1
Hardware: Macintosh → All
Target Milestone: --- → mozilla1.8.1
(Assignee)

Comment 1

11 years ago
Created attachment 238364 [details] [diff] [review]
fix

This is zero-risk.  The bug originated in the fix for bug 316885 last fall.

/be
Attachment #238364 - Flags: review?(mrbkap)
Attachment #238364 - Flags: approval1.8.1?
(Assignee)

Comment 2

11 years ago
Comment on attachment 238364 [details] [diff] [review]
fix

Going for igor r+ in case mrbkap is busy at school, and since igor reviewed 316885.

/be
Attachment #238364 - Flags: review?(igor.bukanov)
(Assignee)

Comment 3

11 years ago
The bug was failure to initialize stack bounded by fp->sp, therefore scanned by the GC -- the vp = sp++ was violating the PUSH macro's tiny level of abstraction. That trick never works!

/be
Status: NEW → ASSIGNED

Updated

11 years ago
Attachment #238364 - Flags: review?(mrbkap) → review+
(Assignee)

Comment 4

11 years ago
Fixed on trunk.

/be
Status: ASSIGNED → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → FIXED

Comment 5

11 years ago
Created attachment 238405 [details]
js1_5/GC/regress-352606.js

Updated

11 years ago
Flags: in-testsuite+

Updated

11 years ago
Attachment #238364 - Flags: review?(igor.bukanov) → review+

Comment 6

11 years ago
Comment on attachment 238364 [details] [diff] [review]
fix

a=schrep
Attachment #238364 - Flags: approval1.8.1? → approval1.8.1+
(Assignee)

Comment 7

11 years ago
Fixed on the 1.8 branch.

/be
Keywords: fixed1.8.1
Flags: blocking1.8.0.8?

Comment 8

11 years ago
verified fixed 1.9 20060914 windows/mac*/linux
Status: RESOLVED → VERIFIED

Comment 9

11 years ago
verified fixed 1.8 20060915 windows/mac*/linux
Keywords: fixed1.8.1 → verified1.8.1
Restoring lost blocking flag
Flags: blocking1.8.0.9?
Flags: blocking1.8.0.9? → blocking1.8.0.8?
Whiteboard: [sg:critical?]
Flags: blocking1.8.0.8? → blocking1.8.0.8+
Comment on attachment 238364 [details] [diff] [review]
fix

approved for 1.8.0 branch, a=dveditz for drivers
Attachment #238364 - Flags: approval1.8.0.8+
(Assignee)

Comment 12

11 years ago
Fixed on the 1.8.0 branch:

Checking in jsinterp.c;
/cvsroot/mozilla/js/src/jsinterp.c,v  <--  jsinterp.c
new revision: 3.181.2.17.2.21; previous revision: 3.181.2.17.2.20
done

/be
Keywords: fixed1.8.0.8
(Assignee)

Comment 13

11 years ago
Created attachment 240224 [details] [diff] [review]
what i checked into the 1.8.0 branch

Comment 14

11 years ago
verified fixed 1.8.0.8 20060927 windows/mac*/linux
Keywords: fixed1.8.0.8 → verified1.8.0.8
Group: security

Comment 15

10 years ago
/cvsroot/mozilla/js/tests/js1_5/GC/regress-352606.js,v  <--  regress-352606.js
Crash Signature: [@ js_GetGCThingFlags]
You need to log in before you can comment on or make changes to this bug.