TM: Crash [@ js_AttemptCompilation]

VERIFIED FIXED in mozilla1.9.2a1

Status

()

Core
JavaScript Engine
P1
critical
VERIFIED FIXED
9 years ago
5 years ago

People

(Reporter: gkw, Assigned: gal)

Tracking

(Blocks: 1 bug, 4 keywords)

Trunk
mozilla1.9.2a1
x86
Mac OS X
crash, regression, testcase, verified1.9.1
Points:
---
Dependency tree / graph
Bug Flags:
blocking1.9.1 +
in-testsuite -

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-tracemonkey, crash signature)

Attachments

(1 attachment)

(Reporter)

Description

9 years ago
for each (let x in [eval, eval, new String('')]) { for(let y in [[]]) NaN = x; }

crashes both opt and debug TM js shells with -j only, near null at js_AttemptCompilation.

This should be a regression of bug 481793.

The first bad revision is:
changeset:   25778:ec90dd58f1da
user:        Andreas Gal
date:        Fri Mar 06 17:25:04 2009 -0800
summary:     Better coordination of nested tree recording (481793, r=dmandelin).
Flags: blocking1.9.1?
Flags: blocking1.9.1? → blocking1.9.1+
Priority: -- → P1

Updated

9 years ago
Assignee: general → gal

Comment 1

9 years ago
js_AttemptCompilation doesn't NULL check the result of getLoop. Should it? Other sites do.
(Assignee)

Comment 2

9 years ago
Created attachment 368215 [details] [diff] [review]
patch
Attachment #368215 - Flags: review?(graydon)
(Assignee)

Comment 3

9 years ago
Spelling fix: breathe
(Assignee)

Comment 4

9 years ago
review ping

Updated

9 years ago
Attachment #368215 - Flags: review?(graydon) → review+
(Reporter)

Comment 5

9 years ago
try{ eval("this.watch(\"x\", Function)") } catch (e){};
([(x.unwatch("x")) for each (x in [new String(''), this]) for each (y in [0])]);

Here's another testcase that seems to be fixed by the patch in comment #2.

Comment 6

9 years ago
http://hg.mozilla.org/tracemonkey/rev/747655f18836
Whiteboard: fixed-in-tracemonkey

Comment 7

9 years ago
http://hg.mozilla.org/mozilla-central/rev/747655f18836
Status: NEW → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → FIXED
Verified fixed with testcase given in comment 0 on trunk and 1.9.1 with the following debug builds:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20090422 Minefield/3.6a1pre ID:20090422224452

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b4pre) Gecko/20090422 Shiretoko/3.5b4pre ID:20090422122043
Status: RESOLVED → VERIFIED
Keywords: fixed1.9.1 → verified1.9.1
Target Milestone: --- → mozilla1.9.2a1
(Reporter)

Updated

9 years ago
Flags: in-testsuite?
Crash Signature: [@ js_AttemptCompilation]
Bug in removed tracer code, setting in-testsuite- flag.
Flags: in-testsuite? → in-testsuite-
You need to log in before you can comment on or make changes to this bug.