360776 - bclary's js1_7 test shows potential problems in 2.0 on the first run under valgrind.

Status: RESOLVED DUPLICATE of bug 410852

(Core :: JavaScript Engine, defect)

Description

[georgi - hopefully not receiving bugspam]

bclary's js1_7 test shows potential problems in 2.0 on the first run
under valgrind. (on both 2.0 and 2.0-latest). 2.0-latest crashes - in
case this is not known will file a bug.
this may cause subtle js problems.

valgrind is available at:
http://valgrind.org/

http://test.bclary.com/tests/mozilla.org/js/menu.html
js1_7
select:
+ block
+ expressions
run tests

==9339== 
==9339== Invalid read of size 4
==9339==    at 0x40618B2: js_PopStatement (jsemit.c:1461)
==9339==    by 0x40CF41D: FunctionBody (jsparse.c:740)
==9339== 
   by 0x40D0A50: FunctionDef (jsparse.c:1301) 
==9339==    by 0x40D0E58: FunctionStmt (jsparse.c:1418)
==9339==    by 0x40D3AFF: Statement (jsparse.c:2539)
==9339==    by 0x40D0F7A: Statements (jsparse.c:1450)
==9339==    by 0x40CED18: js_CompileTokenStream (jsparse.c:499)
==9339==    by 0x404247D: CompileTokenStream (jsapi.c:3842)
==9339==    by 0x404272E: JS_CompileUCScriptForPrincipals (jsapi.c:3937)
==9339==    by 0x404377F: JS_EvaluateUCScriptForPrincipals (jsapi.c:4359)
==9339==    by 0x73E699D: nsJSContext::EvaluateString(nsAString_internal const&,
 void*, nsIPrincipal*, char const*, unsigned, char const*, nsAString_internal*, 
int*) (nsJSEnvironment.cpp:1100)
==9339==    by 0x726E3F7: nsScriptLoader::EvaluateScript(nsScriptLoadRequest*, nsString const&) (nsScriptLoader.cpp:774)
==9339==  Address 0xBEC4F040 is just below the stack ptr.  To suppress, use: --w
orkaround-gcc296-bugs=yes
==9339== 
==9339== Invalid read of size 2
==9339==    at 0x40618BE: js_PopStatement (jsemit.c:1462)
==9339==    by 0x40CF41D: FunctionBody (jsparse.c:740)
==9339==    by 0x40D0A50: FunctionDef (jsparse.c:1301)
==9339==    by 0x40D0E58: FunctionStmt (jsparse.c:1418)
==9339==    by 0x40D3AFF: Statement (jsparse.c:2539)
==9339==    by 0x40D0F7A: Statements (jsparse.c:1450)
==9339==    by 0x40CED18: js_CompileTokenStream (jsparse.c:499)
==9339==    by 0x404247D: CompileTokenStream (jsapi.c:3842)
==9339==    by 0x404272E: JS_CompileUCScriptForPrincipals (jsapi.c:3937)
==9339==    by 0x404377F: JS_EvaluateUCScriptForPrincipals (jsapi.c:4359)
==9339==    by 0x73E699D: nsJSContext::EvaluateString(nsAString_internal const&, void*, nsIPrincipal*, char const*, unsigned, char const*, nsAString_internal*, 
int*) (nsJSEnvironment.cpp:1100)
==9339==    by 0x726E3F7: nsScriptLoader::EvaluateScript(nsScriptLoadRequest*, n
sString const&) (nsScriptLoader.cpp:774)
==9339==  Address 0xBEC4F02A is jus

Comment 1

[Bob Clary [:bc] (inactive)]

Hmm, I just recently ran a valgrind run on the trunk for each test: start browser, load and run test, then shutdown; and didn't see any violations. I can do the same for the 1.8.1 branch if that would be worthwhile.

Comment 2

[georgi - hopefully not receiving bugspam]

2.0-latest even crashes on js1_7 test.

valgrind complains *only on the first load of the test* - later it doesn't.

tested this way: start valgrind and load your url as the first one then watch.

Comment 3

[Bob Clary [:bc] (inactive)]

Attachment: recent crashes

this shows recent crashes all on the 1.8.1 branch. I don't see trunk crashes on windows/linux but don't have test coverage on the mac trunk anymore.

Comment 4

[georgi - hopefully not receiving bugspam]

in case it is still valid, i suspect it is [nse?]

Comment 5

[Robert Sayre]

I think I filed this on 1.9 and mrbkap fixed it.

Comment 6

[Robert Sayre]

yes, bug 410852?

Comment 7

[Josh Aas]

Bob Clary reported this fixed on trunk in comment #3, we don't support the 1.8 branch any more, and Rob suggested that the fixed public bug for this is bug 410852.

Opening this up and duping it against bug 410852.