462851 - JS_SealObject crash if deep is true.

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Franck]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.3) Gecko/2008092417 Firefox/3.0.3
Build Identifier: mozilla-central-5bd6876be7f2/js/src (tip at Oct 28, 2008)

calling JS_SealObject(cx, myObj, deep) crash if deep is true.


Reproducible: Always

Steps to Reproduce:
JSObject *myObj = JS_NewObject(cx, NULL, NULL, NULL);
JS_SealObject(cx, myObj, JS_TRUE);

Actual Results:  
crash in jsfun.cpp:716 (call_enumerate function):
...
fun = js_GetCallObjectFunction(); // returns NULL
JS_GET_LOCAL_NAME_COUNT(fun); // (fun)->u.i.nupvars -> Access violation
...



I use TraceMonkey code from mozilla-central-5bd6876be7f2/js/src compiled with JIT disabled.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

This is an amazingly rare case, I think it's only exposed via the seal() API.

Comment 3

[Jason Orendorff [:jorendorff]]

Note that in 469124 this happened via Venkman, so it's not quite as rare as we thought.  Is there a reason not to push this?

Comment 4

[Brendan Eich [:brendan]]

The patch just got approved -- mrbkap will push soon, I'm sure.

/be

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/3a4b803d4e47

Comment 6

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/21380cf2e4f2

Comment 8

[Mike Beltzner [:beltzner, not reading bugmail]]

JJB had marked this as blocking? in bug 471066, carrying that over here.

Comment 9

[John J. Barton]

I built:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b3pre) Gecko/20090105 Shiretoko/3.1b3pre
and I repeated the test from bug 471066. No crash.Thanks!