488501 - TM Crash [@ js_GetUpvar ]

Status: RESOLVED DUPLICATE of bug 488421

(Core :: JavaScript Engine, defect, P1)

Description

[Ria Klaassen (not reading all bugmail)]

With the latest tracemonkey build containing the fix of Bug 488015 I get crash:
http://crash-stats.mozilla.com/report/index/1571f9e8-a88b-4960-a522-07a632090415?p=1

STR:

- go to http://www.nujij.nl//amerikaanse-praktijken-in-centrum-rotterdam.5366680.lynkx
- scroll down and click on Log in.

Then it should crash after some seconds. The crash already existed some hours earlier with crash ID http://crash-stats.mozilla.com/report/index/fdf1a195-c775-46bb-b3b5-24b022090415

Comment 1

[Brendan Eich [:brendan]]

Any reduction would be great -- I will work on one today as time allows.

/be

Comment 2

[Brendan Eich [:brendan]]

Confirmed dup of bug 488421, whose patch fixes this bug. Thanks for the fast reporting. The implicated lines are the anonymous function created by the eval at the bottom of this excerpt, called from a timeout.

/be

function AttachEventHandler( htmlElement, eventName, delegate )
{
   // Lower event
   eventName = eventName.toLowerCase();

   // Check if a event list is available
   var eventList = htmlElement.eventList;
   if ( eventList == null )
   {
      eventList = new Array();
      htmlElement.eventList = eventList;
   }

   // Check if a delegate list is avalable
   var delegateList = eventList[ eventName ];
   if ( delegateList == null )
   {
      delegateList = new Array();
      eventList[ eventName ] = delegateList;

      // Attach event
      eval( 'htmlElement.' + eventName + '= function(actualEvent) {' +
               'FireEvent( htmlElement, eventName, actualEvent ); }' );
   }