Last Comment Bug 457093 - toString on js function w/ try catch silently hangs js execution
: toString on js function w/ try catch silently hangs js execution
Status: VERIFIED FIXED
: regression, testcase, verified1.8.1.18
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: 1.8 Branch
: All All
: -- normal (vote)
: ---
Assigned To: Brian Crowder
:
: Jason Orendorff [:jorendorff]
Mentors:
: 456897 456964 457062 457181 457417 457798 (view as bug list)
Depends on:
Blocks: 437288
  Show dependency treegraph
 
Reported: 2008-09-25 14:54 PDT by Mathieu Fenniak
Modified: 2008-09-30 12:00 PDT (History)
22 users (show)
dveditz: blocking1.8.1.18+
dveditz: wanted1.8.1.x+
bob: in‑testsuite+
bob: in‑litmus-
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
minimal test case (307 bytes, text/html)
2008-09-25 14:54 PDT, Mathieu Fenniak
no flags Details
the fix (1.43 KB, patch)
2008-09-26 09:20 PDT, Brian Crowder
no flags Details | Diff | Splinter Review
Whoops, without junk this time. (934 bytes, patch)
2008-09-26 09:21 PDT, Brian Crowder
brendan: review+
dveditz: approval1.8.1.18+
Details | Diff | Splinter Review

Description Mathieu Fenniak 2008-09-25 14:54:51 PDT
Created attachment 340435 [details]
minimal test case

In attached test case, the "alert" function is never reached in normal execution.  It appears that calling toString on the method with a try { } catch (E) {} block stops further JS execution (without a visible exception).

This issue only occurs in Firefox 2.0.0.17; it does not occur in FF 3 or FF 2.0.0.16.
Comment 1 Brendan Eich [:brendan] 2008-09-25 15:12:18 PDT
Gary, do you have branch ability to bisect and find the regressing cvs commit?

/be
Comment 2 Henrik Skupin (:whimboo) 2008-09-25 15:49:59 PDT
Same happens with Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.17) Gecko/20080829 Firefox/2.0.0.17
Comment 3 Carsten Book [:Tomcat] 2008-09-25 17:46:13 PDT
Ok found the Regression Range:

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.17pre)
Gecko/2008080703 BonEcho/2.0.0.17pre -> works with the Testcase
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.17pre)
Gecko/2008080803 BonEcho/2.0.0.17pre -> fails on the Testcase

Bonsai Query for this Timeframe : http://tinyurl.com/4vkc7v

So regression from Bug 437288 ?
Comment 4 Daniel Veditz [:dveditz] 2008-09-25 18:05:00 PDT
if that's the regression range bug 437288 looks like the culprit to me, too. Brian?
Comment 5 Brendan Eich [:brendan] 2008-09-25 18:06:49 PDT
Tomcat, many thanks. See bug 437288 comment 16, which cites the bad merge I found by diffing patches (not interdiff, it failed; diff with grep to strip out context jitter).

Brian, could you field this one? Thanks.

/be
Comment 6 Mike Beltzner [:beltzner, not reading bugmail] 2008-09-26 01:07:13 PDT
What's the impact of this in terms of broken websites and add-ons?
Comment 7 Bob Clary [:bc:] 2008-09-26 01:19:53 PDT
not really a hang but more of script termination with no error in opt.

Assertion failure: newtop <= oldtop, at jsopcode.c:1988

/cvsroot/mozilla/js/tests/js1_5/decompilation/regress-457093-01.js,v  <-- 
regress-457093-01.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/2e7f03bc1820
Comment 8 Gary Kwong [:gkw] [:nth10sd] 2008-09-26 03:19:12 PDT
(In reply to comment #3)
> Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.17pre)
> Gecko/2008080703 BonEcho/2.0.0.17pre -> works with the Testcase
> Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.17pre)
> Gecko/2008080803 BonEcho/2.0.0.17pre -> fails on the Testcase

(what a morning to wake up to; I could only hop on to this in the late afternoon local time)

Confirming Tomcat's regression range:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.17pre) Gecko/20080807 BonEcho/2.0.0.17pre -> works on testcase, dialog shows up.
Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.17pre) Gecko/20080808 BonEcho/2.0.0.17pre -> fails on testcase, dialog doesn't show up.
Comment 9 Mathieu Fenniak 2008-09-26 08:53:21 PDT
(In reply to comment #6)
> What's the impact of this in terms of broken websites and add-ons?

This issue and bug 456964 break a web application named Replicon Web TimeSheet, making it unusable with Firefox 2.0.0.17.  Web TimeSheet has over 20,000 active users; our support department has received about a dozen tickets regarding FF 2.0.0.17 in the past two days.  We only expect support calls to increase as more users apply the software update.
Comment 10 Brian Crowder 2008-09-26 09:20:27 PDT
Created attachment 340592 [details] [diff] [review]
the fix
Comment 11 Brian Crowder 2008-09-26 09:21:32 PDT
Created attachment 340593 [details] [diff] [review]
Whoops, without junk this time.
Comment 12 Brian Crowder 2008-09-26 09:25:27 PDT
*** Bug 456964 has been marked as a duplicate of this bug. ***
Comment 13 Daniel Veditz [:dveditz] 2008-09-26 11:33:24 PDT
Comment on attachment 340593 [details] [diff] [review]
Whoops, without junk this time.

Approved for 1.8.1.18, a=dveditz
Comment 14 Matthias Versen [:Matti] 2008-09-26 16:22:03 PDT
*** Bug 457181 has been marked as a duplicate of this bug. ***
Comment 15 Daniel Veditz [:dveditz] 2008-09-26 20:29:02 PDT
*** Bug 457062 has been marked as a duplicate of this bug. ***
Comment 16 Brian Crowder 2008-09-27 02:04:46 PDT
I might not get to this this weekend, so help is appreciated.
Comment 17 Bob Clary [:bc:] 2008-09-27 05:52:23 PDT
see also bug 457417
Comment 18 Bob Clary [:bc:] 2008-09-28 07:31:32 PDT
also js1_5/Regress/regress-252892.js Assertion failure: top != 0 is fixed by this patch.
Comment 19 Bob Clary [:bc:] 2008-09-28 07:57:58 PDT
also js1_5/Regress/regress-417893.js browser only Assertion failure: top != 0
Comment 20 Bob Clary [:bc:] 2008-09-28 08:30:16 PDT
also js1_5/decompilation/regress-456964-01.js and e4x/decompilation/regress-355474-01.js Assertion failure: top != 0
Comment 21 :Gavin Sharp [email: gavin@gavinsharp.com] 2008-09-29 08:32:51 PDT
mozilla/js/src/jsopcode.c 	3.89.2.78
Comment 22 Alex Vincent [:WeirdAl] 2008-09-29 10:58:17 PDT
*** Bug 456897 has been marked as a duplicate of this bug. ***
Comment 23 Daniel Veditz [:dveditz] 2008-09-29 11:38:50 PDT
*** Bug 457417 has been marked as a duplicate of this bug. ***
Comment 24 YUKI "Piro" Hiroshi 2008-09-30 01:57:20 PDT
*** Bug 457798 has been marked as a duplicate of this bug. ***
Comment 25 Mathieu Fenniak 2008-09-30 08:47:50 PDT
Confirmed fixed in FF nightly 2008-09-30-03-mozilla1.8
Comment 26 Henrik Skupin (:whimboo) 2008-09-30 09:57:01 PDT
Also verified with Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.18pre) Gecko/20080930 BonEcho/2.0.0.18pre
Comment 27 Bob Clary [:bc:] 2008-09-30 12:00:50 PDT
all tests pass 1.8.1 opt/debug shell/browser linux/mac/windows.

Note You need to log in before you can comment on or make changes to this bug.