355512 - Crash [@ MarkGCThingChildren] involving "arguments" from generator

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

This is probably related to bug 355486 in some way.

To reproduce: give this to the js shell as a file or by pasting.


function foopy()
{
  var f = function(){ r = arguments; d.d.d; yield 170; }
  try { for (var i in f()) { } } catch (iterError) { }   
}

typeof uneval;
foopy();
gc();
uneval(r);
gc();

Comment 1

[Brendan Eich [:brendan]]

Attachment: fix

Comment 2

[Brendan Eich [:brendan]]

Attachment: better fix pointed out by Igor

Comment 3

[Igor Bukanov]

Comment on attachment 241402 [details] [diff] [review]
better fix pointed out by Igor

Marking always is good.

Comment 4

[Brendan Eich [:brendan]]

Fixed on trunk, bowdlerized bug number:

Checking in jsiter.c;
/cvsroot/mozilla/js/src/jsiter.c,v  <--  jsiter.c
new revision: 3.53; previous revision: 3.52
done

/be

Comment 5

[Bob Clary [:bc] (inactive)]

Attachment: js1_7/regress/regress-355512.js

Comment 6

[Mike Beltzner [:beltzner, not reading bugmail]]

Blocking for Fx2 RC3

Comment 7

[Mike Schroepfer]

Comment on attachment 241402 [details] [diff] [review]
better fix pointed out by Igor

Approved for RC3.

Comment 8

[Brendan Eich [:brendan]]

Fixed on the 1.8 branch (checkin mentions attachment id):

Checking in jsiter.c;
/cvsroot/mozilla/js/src/jsiter.c,v  <--  jsiter.c
new revision: 3.17.2.23; previous revision: 3.17.2.22
done

/be

Comment 9

[Bob Clary [:bc] (inactive)]

verified fixed 1.9 20061007 windows/linux

Comment 10

[Bob Clary [:bc] (inactive)]

verified fixed 20061009 1.8 windows/linux/mac* 1.9 windows/linux

Comment 11

[Daniel Veditz [:dveditz]]

clearing nomination flag and security flag for fixed bug.

Comment 12

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_7/extensions/regress-355512.js,v  <--  regress-355512.js