Last Comment Bug 457093 - toString on js function w/ try catch silently hangs js execution
: toString on js function w/ try catch silently hangs js execution
Status: VERIFIED FIXED
: regression, testcase, verified1.8.1.18
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: 1.8 Branch
: All All
: -- normal (vote)
: ---
Assigned To: Brian Crowder
:
: Jason Orendorff [:jorendorff]
Mentors:
: 456897 456964 457062 457181 457417 457798 (view as bug list)
Depends on:
Blocks: 437288
  Show dependency treegraph
 
Reported: 2008-09-25 14:54 PDT by Mathieu Fenniak
Modified: 2008-09-30 12:00 PDT (History)
22 users (show)
dveditz: blocking1.8.1.18+
dveditz: wanted1.8.1.x+
bob: in‑testsuite+
bob: in‑litmus-
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
minimal test case (307 bytes, text/html)
2008-09-25 14:54 PDT, Mathieu Fenniak
no flags Details
the fix (1.43 KB, patch)
2008-09-26 09:20 PDT, Brian Crowder
no flags Details | Diff | Splinter Review
Whoops, without junk this time. (934 bytes, patch)
2008-09-26 09:21 PDT, Brian Crowder
brendan: review+
dveditz: approval1.8.1.18+
Details | Diff | Splinter Review

Description User image Mathieu Fenniak 2008-09-25 14:54:51 PDT
Created attachment 340435 [details]
minimal test case

In attached test case, the "alert" function is never reached in normal execution.  It appears that calling toString on the method with a try { } catch (E) {} block stops further JS execution (without a visible exception).

This issue only occurs in Firefox 2.0.0.17; it does not occur in FF 3 or FF 2.0.0.16.
Comment 1 User image Brendan Eich [:brendan] 2008-09-25 15:12:18 PDT
Gary, do you have branch ability to bisect and find the regressing cvs commit?

/be
Comment 2 User image Henrik Skupin (:whimboo) 2008-09-25 15:49:59 PDT
Same happens with Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.17) Gecko/20080829 Firefox/2.0.0.17
Comment 3 User image Carsten Book [:Tomcat] 2008-09-25 17:46:13 PDT
Ok found the Regression Range:

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.17pre)
Gecko/2008080703 BonEcho/2.0.0.17pre -> works with the Testcase
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.17pre)
Gecko/2008080803 BonEcho/2.0.0.17pre -> fails on the Testcase

Bonsai Query for this Timeframe : http://tinyurl.com/4vkc7v

So regression from Bug 437288 ?
Comment 4 User image Daniel Veditz [:dveditz] 2008-09-25 18:05:00 PDT
if that's the regression range bug 437288 looks like the culprit to me, too. Brian?
Comment 5 User image Brendan Eich [:brendan] 2008-09-25 18:06:49 PDT
Tomcat, many thanks. See bug 437288 comment 16, which cites the bad merge I found by diffing patches (not interdiff, it failed; diff with grep to strip out context jitter).

Brian, could you field this one? Thanks.

/be
Comment 6 User image Mike Beltzner [:beltzner, not reading bugmail] 2008-09-26 01:07:13 PDT
What's the impact of this in terms of broken websites and add-ons?
Comment 7 User image Bob Clary [:bc:] 2008-09-26 01:19:53 PDT
not really a hang but more of script termination with no error in opt.

Assertion failure: newtop <= oldtop, at jsopcode.c:1988

/cvsroot/mozilla/js/tests/js1_5/decompilation/regress-457093-01.js,v  <-- 
regress-457093-01.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/2e7f03bc1820
Comment 8 User image Gary Kwong [:gkw] [:nth10sd] 2008-09-26 03:19:12 PDT
(In reply to comment #3)
> Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.17pre)
> Gecko/2008080703 BonEcho/2.0.0.17pre -> works with the Testcase
> Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.17pre)
> Gecko/2008080803 BonEcho/2.0.0.17pre -> fails on the Testcase

(what a morning to wake up to; I could only hop on to this in the late afternoon local time)

Confirming Tomcat's regression range:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.17pre) Gecko/20080807 BonEcho/2.0.0.17pre -> works on testcase, dialog shows up.
Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.17pre) Gecko/20080808 BonEcho/2.0.0.17pre -> fails on testcase, dialog doesn't show up.
Comment 9 User image Mathieu Fenniak 2008-09-26 08:53:21 PDT
(In reply to comment #6)
> What's the impact of this in terms of broken websites and add-ons?

This issue and bug 456964 break a web application named Replicon Web TimeSheet, making it unusable with Firefox 2.0.0.17.  Web TimeSheet has over 20,000 active users; our support department has received about a dozen tickets regarding FF 2.0.0.17 in the past two days.  We only expect support calls to increase as more users apply the software update.
Comment 10 User image Brian Crowder 2008-09-26 09:20:27 PDT
Created attachment 340592 [details] [diff] [review]
the fix
Comment 11 User image Brian Crowder 2008-09-26 09:21:32 PDT
Created attachment 340593 [details] [diff] [review]
Whoops, without junk this time.
Comment 12 User image Brian Crowder 2008-09-26 09:25:27 PDT
*** Bug 456964 has been marked as a duplicate of this bug. ***
Comment 13 User image Daniel Veditz [:dveditz] 2008-09-26 11:33:24 PDT
Comment on attachment 340593 [details] [diff] [review]
Whoops, without junk this time.

Approved for 1.8.1.18, a=dveditz
Comment 14 User image Matthias Versen [:Matti] 2008-09-26 16:22:03 PDT
*** Bug 457181 has been marked as a duplicate of this bug. ***
Comment 15 User image Daniel Veditz [:dveditz] 2008-09-26 20:29:02 PDT
*** Bug 457062 has been marked as a duplicate of this bug. ***
Comment 16 User image Brian Crowder 2008-09-27 02:04:46 PDT
I might not get to this this weekend, so help is appreciated.
Comment 17 User image Bob Clary [:bc:] 2008-09-27 05:52:23 PDT
see also bug 457417
Comment 18 User image Bob Clary [:bc:] 2008-09-28 07:31:32 PDT
also js1_5/Regress/regress-252892.js Assertion failure: top != 0 is fixed by this patch.
Comment 19 User image Bob Clary [:bc:] 2008-09-28 07:57:58 PDT
also js1_5/Regress/regress-417893.js browser only Assertion failure: top != 0
Comment 20 User image Bob Clary [:bc:] 2008-09-28 08:30:16 PDT
also js1_5/decompilation/regress-456964-01.js and e4x/decompilation/regress-355474-01.js Assertion failure: top != 0
Comment 21 User image :Gavin Sharp [email: gavin@gavinsharp.com] 2008-09-29 08:32:51 PDT
mozilla/js/src/jsopcode.c 	3.89.2.78
Comment 22 User image Alex Vincent [:WeirdAl] 2008-09-29 10:58:17 PDT
*** Bug 456897 has been marked as a duplicate of this bug. ***
Comment 23 User image Daniel Veditz [:dveditz] 2008-09-29 11:38:50 PDT
*** Bug 457417 has been marked as a duplicate of this bug. ***
Comment 24 User image YUKI "Piro" Hiroshi 2008-09-30 01:57:20 PDT
*** Bug 457798 has been marked as a duplicate of this bug. ***
Comment 25 User image Mathieu Fenniak 2008-09-30 08:47:50 PDT
Confirmed fixed in FF nightly 2008-09-30-03-mozilla1.8
Comment 26 User image Henrik Skupin (:whimboo) 2008-09-30 09:57:01 PDT
Also verified with Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.18pre) Gecko/20080930 BonEcho/2.0.0.18pre
Comment 27 User image Bob Clary [:bc:] 2008-09-30 12:00:50 PDT
all tests pass 1.8.1 opt/debug shell/browser linux/mac/windows.

Note You need to log in before you can comment on or make changes to this bug.