367630 - Crash with use of sharp variable in function [@ js_PCToLineNumber]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

js> uneval(#1={a:#1#}); (function() { return #1# })();
Segmentation fault

js> w = {a:#1=function(){return #1#}}; w.a()
Segmentation fault

In the first example, the #1# is clearly illegal due to being out of scope, right?  Why does the function even compile?  Is the second example also illegal?

Here's the top of a stack trace from the js shell:

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_INVALID_ADDRESS (0x0001) at 0xdadadada

Thread 0 Crashed:
0   js_PCToLineNumber + 68 (jsscript.c:1519)
1   js_ReportErrorNumberVA + 236 (jscntxt.c:1141)
2   JS_ReportErrorNumber + 96 (jsapi.c:4672)
3   js_Interpret + 90244 (jsinterp.c:5336)
4   js_Execute + 904 (jsinterp.c:1607)
5   JS_ExecuteScript + 64 (jsapi.c:4212)
...

Comment 1

[Jesse Ruderman]

I found this while messing around in the js shell, but I plan to add sharps to a fuzzer soon ;)

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Easy fix

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 252230 [details] [diff] [review]
Easy fix

r=me (pls. cc: me on bugs like this; wish r? cc'd me automatically).

/be

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Fixed on trunk.

Comment 5

[Bob Clary [:bc] (inactive)]

Attachment: js1_5/extensions/regress-367630.js

reliably crashes 1.8.1 but does not crash 1.8.0

Comment 6

[Bob Clary [:bc] (inactive)]

verified fixed 1.9.0 20070226 windows/mac*/linux

Comment 7

[Daniel Veditz [:dveditz]]

Comment on attachment 252230 [details] [diff] [review]
Easy fix

approved for 1.8.0.12 and 1.8.1.4, a=dveditz for release-drivers

Comment 8

[Blake Kaplan (:mrbkap) (inactive)]

Fixed on the 1.8 branches.

Comment 9

[Bob Clary [:bc] (inactive)]

verified fixed linux, windows, mac* 1.8.0, 1.8.1 shell 20070406

Comment 10

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_5/extensions/regress-367630.js,v  <--  regress-367630.js
initial revision: 1.1