361451 - GC crash [@ js_SearchScope] with E4X, watch, import

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

Pasting this into the JavaScript shell or giving it to the shell as a file causes a crash:

var obj = <z><yyy/></z>;
obj.watch('x', print);
try { import obj.yyy; } catch(e) { }
obj = undefined;
gc();

The crash happens both with and without the patch for bug 361346.

The crash looks like a null deref.  Here's a debug stack trace:

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000014

Thread 0 Crashed:
0   js 	0x00070b90 js_SearchScope + 220 (jsscope.c:265)
1   js 	0x000708e0 CreateScopeTable + 416 (jsscope.c:132)
2   js 	0x00072644 js_AddScopeProperty + 1020 (jsscope.c:981)
3   js 	0x000731b4 js_ChangeScopePropertyAttrs + 840 (jsscope.c:1284)
4   js 	0x00048b34 js_ChangeNativePropertyAttrs + 124 (jsobj.c:2906)
5   js 	0x00023cb4 DropWatchPoint + 232 (jsdbgapi.c:269)
6   js 	0x000251bc JS_ClearWatchPointsForObject + 100 (jsdbgapi.c:608)
7   js 	0x00047fd0 js_FinalizeObject + 184 (jsobj.c:2700)
8   js 	0x000922fc js_GC + 2888 (jsgc.c:3016)
...

Comment 1

[Brendan Eich [:brendan]]

Attachment: fix

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 246243 [details] [diff] [review]
fix

I was going to write exactly this patch, but didn't get a chance to ;-).

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 246243 [details] [diff] [review]
fix

Igor, you're welcome to review too.  I'm checking into the trunk with r=mrbkap to get this lined up for 1.8.1.1.

/be

Comment 4

[Brendan Eich [:brendan]]

Checking in jsgc.c;
/cvsroot/mozilla/js/src/jsgc.c,v  <--  jsgc.c
new revision: 3.181; previous revision: 3.180
done

/be

Comment 5

[Bob Clary [:bc] (inactive)]

RCS file: /cvsroot/mozilla/js/tests/e4x/Regress/regress-361451.js,v
done
Checking in regress-361451.js;
/cvsroot/mozilla/js/tests/e4x/Regress/regress-361451.js,v  <--  regress-361451.js
initial revision: 1.1
done

note this did crash 11/21's morning trunk debug shell on windows but not the 1.8.1.1 shell and didn't crash either on Linux.

Comment 6

[Bob Clary [:bc] (inactive)]

verified fixed 20061122 1.9 windows/linux

Comment 7

[Daniel Veditz [:dveditz]]

Comment on attachment 246243 [details] [diff] [review]
fix

approved for 1.8 branch, a=dveditz for drivers

Comment 8

[Brendan Eich [:brendan]]

This landed as part of the patch for bug 347306 and bug 360612.

/be

Comment 9

[Bob Clary [:bc] (inactive)]

verified fixed 20061130 1.8.1.1 window/linux/mac*