452495 - TM: Crash [@ TraceRecorder::getThis] with |new|

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

./js -j
js> for (var j = 0; j < 4; ++j) { try { new 1(this); } catch(e) { } }

Crash [@ TraceRecorder::getThis] dereferencing 0xfffffffc

Tracemonkey branch revision 90bb1fa51f16, which includes brendan's changeset eee9a90b81cb "Fix a bug Jesse reported: insufficient copy/paste from record_JSOP_CALL to record_JSOP_NEW".  That changeset fixed an assertion with a related testcase, but apparently it didn't fix this crash.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/tracemonkey/index.cgi/rev/e10d435a9ea4

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Comment 1 is in the wrong bug.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Can no longer reproduce -- looks like we correctly abort now.

Comment 4

[Jesse Ruderman]

Still crashes for me on tracemonkey branch.

Comment 5

[Andreas Gal :gal]

Attachment: Removed bogus assert (cx->fp->argv is NULL in global scope).

Comment 7

[Jesse Ruderman]

Is it actually crashing while trying to evaluate the truthiness (??) of that assertion?

Comment 8

[Andreas Gal :gal]

No, the this caused it IMO.

Comment 9

[Andreas Gal :gal]

http://hg.mozilla.org/tracemonkey/rev/528dc22c3729

Comment 10

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_5/Regress/regress-452495.js,v  <--  regress-452495.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/d8cf927f80be