352797 - "Assertion failure: OBJ_GET_CLASS(cx, obj) == &js_BlockClass" with xml filtering predicate operator, eval.call, let

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

js> (function() { let (x = eval.call(<x/>.(1), "")) {} })()     
Assertion failure: OBJ_GET_CLASS(cx, obj) == &js_BlockClass, at jsinterp.c:6024

Comment 1

[Jesse Ruderman]

Seems like a null deref in opt builds.

Comment 2

[Jesse Ruderman]

js> (function(){let x = 'fafafa'.replace(/a/g, new Script(''))})()
Assertion failure: OBJ_GET_CLASS(cx, obj) == &js_BlockClass, at jsinterp.c:5835

Comment 3

[Brendan Eich [:brendan]]

Attachment: fix

We really should have seen this when hacking js_GetScopeChain.

/be

Comment 4

[Brendan Eich [:brendan]]

Fixed on trunk:

Checking in jsfun.c;
/cvsroot/mozilla/js/src/jsfun.c,v  <--  jsfun.c
new revision: 3.168; previous revision: 3.167
done
Checking in jsinterp.c;
/cvsroot/mozilla/js/src/jsinterp.c,v  <--  jsinterp.c
new revision: 3.298; previous revision: 3.297
done

/be

Comment 5

[Brendan Eich [:brendan]]

The fix introduced bug 356250.

/be

Comment 6

[Bob Clary [:bc] (inactive)]

RCS file: /cvsroot/mozilla/js/tests/js1_7/regress/regress-352797-01.js,v
done
Checking in regress-352797-01.js;
/cvsroot/mozilla/js/tests/js1_7/regress/regress-352797-01.js,v  <--  regress-352797-01.js
initial revision: 1.1
done
RCS file: /cvsroot/mozilla/js/tests/js1_7/regress/regress-352797-02.js,v
done
Checking in regress-352797-02.js;
/cvsroot/mozilla/js/tests/js1_7/regress/regress-352797-02.js,v  <--  regress-352797-02.js
initial revision: 1.1
done

Comment 7

[Bob Clary [:bc] (inactive)]

verified fixed 1.9 20061012 windows/linux

Comment 8

[Daniel Veditz [:dveditz]]

Comment on attachment 241748 [details] [diff] [review]
fix

approved for 1.8 branch, a=dveditz for drivers

Comment 9

[Brendan Eich [:brendan]]

Fixed on the 1.8 branch:

Checking in jsfun.c;
/cvsroot/mozilla/js/src/jsfun.c,v  <--  jsfun.c
new revision: 3.117.2.26; previous revision: 3.117.2.25
done
Checking in jsinterp.c;
/cvsroot/mozilla/js/src/jsinterp.c,v  <--  jsinterp.c
new revision: 3.181.2.72; previous revision: 3.181.2.71
done

(along with the followup fix for bug 356250).

/be

Comment 10

[Bob Clary [:bc] (inactive)]

verified fixed 20061122 1.8.1.1 windows/linux/mac*, 1.9 windows/linux

Comment 11

[Bob Clary [:bc] (inactive)]

catch the indirect eval exception on trunk

/cvsroot/mozilla/js/tests/js1_7/regress/regress-352797-02.js,v  <--  regress-352797-02.js
new revision: 1.3; previous revision: 1.2