452491 - TM: Null deref [@ JITted code] with |new|

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

./js -j c.js
Bus error

I can only reproduce by giving ./js a file, not by pasting into the interactive shell.  c.js is:

for (var j=0;j<5;++j) (new (function(q) q)).a;

I'm testing using the tracemonkey branch.

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Quick analysis: we're shoving a JSVAL_VOID (2) into the tracker, and somewhere that value is turning into an Object without being updated in the tracker.

Eventually, getProp() sees JSVAL_IS_PRIMITIVE(v) being false but gets a 2 from the tracker and performs a load against it which fails.

Will look more into it tomorrow.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Pushed fix as changeset da0c32f2b9a2.

Comment 3

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_5/Regress/regress-452491.js,v  <--  regress-452491.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/432b17b45f82

Comment 4

[Bob Clary [:bc] (inactive)]

this test should have been in js18

Removing js1_5/Regress/regress-452491.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-452491.js,v  <--  regress-452491.js
new revision: delete; previous revision: 1.1
done
RCS file: /cvsroot/mozilla/js/tests/js1_8/regress/regress-452491.js,v
done
Checking in js1_8/regress/regress-452491.js;
/cvsroot/mozilla/js/tests/js1_8/regress/regress-452491.js,v  <--  regress-452491.js
initial revision: 1.1
done


http://hg.mozilla.org/mozilla-central/rev/e00cb9492acb