482271 - TM: Crash [@ js_AttemptCompilation]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

for each (let x in [eval, eval, new String('')]) { for(let y in [[]]) NaN = x; }

crashes both opt and debug TM js shells with -j only, near null at js_AttemptCompilation.

This should be a regression of bug 481793.

The first bad revision is:
changeset:   25778:ec90dd58f1da
user:        Andreas Gal
date:        Fri Mar 06 17:25:04 2009 -0800
summary:     Better coordination of nested tree recording (481793, r=dmandelin).

Comment 1

[Robert Sayre]

js_AttemptCompilation doesn't NULL check the result of getLoop. Should it? Other sites do.

Comment 2

[Andreas Gal :gal]

Attachment: patch

Comment 3

[Andreas Gal :gal]

Spelling fix: breathe

Comment 4

[Andreas Gal :gal]

review ping

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

try{ eval("this.watch(\"x\", Function)") } catch (e){};
([(x.unwatch("x")) for each (x in [new String(''), this]) for each (y in [0])]);

Here's another testcase that seems to be fixed by the patch in comment #2.

Comment 6

[Robert Sayre]

http://hg.mozilla.org/tracemonkey/rev/747655f18836

Comment 7

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/747655f18836

Comment 8

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/5d2d2c3eb976

Comment 9

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Verified fixed with testcase given in comment 0 on trunk and 1.9.1 with the following debug builds:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20090422 Minefield/3.6a1pre ID:20090422224452

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b4pre) Gecko/20090422 Shiretoko/3.5b4pre ID:20090422122043

Comment 10

[Christian Holler (:decoder)]

Bug in removed tracer code, setting in-testsuite- flag.