Closed Bug 495563 Opened 11 years ago Closed 11 years ago

TM: Crash with (function() { return this; })()

Categories

(Core :: JavaScript Engine, defect, P1)

defect

Tracking

()

VERIFIED FIXED
mozilla1.9.2a1

People

(Reporter: jruderman, Assigned: gal)

References

Details

(4 keywords, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

for (var i = 0; i < 3; ++i) {
  (function() { return this; })();
}

Causes a null deref within JITted code.
does it get branch too?
Assignee: general → gal
Yes, 1.9.1 branch crashes too.
Flags: blocking1.9.1?
autoBisect shows this is probably related to bug 492904 :

The first bad revision is:
changeset:   28601:dbf1b7adc784
user:        Brendan Eich
date:        Tue May 19 12:59:08 2009 -0700
summary:     Bug 492904 - TM: Crash [@ TraceRecorder::test_property_cache] (r=gal).
Blocks: 492904
Keywords: regression
Yeah, I identified the same bug as regressor.
This always reads from 0x00000004, so not exploitable (but crashes of course).
Priority: -- → P1
Target Milestone: --- → mozilla1.9.1
Flags: blocking1.9.1? → blocking1.9.1+
Comment on attachment 380562 [details] [diff] [review]
argv[-1] is updated by ComputeThisForFrame, so sample it early

Comment the load into original by saying that js_ComputeThisForFrame updates argv[-1].

/be
Attachment #380562 - Flags: review?(brendan) → review+
http://hg.mozilla.org/tracemonkey/rev/6355d89f05dc
Whiteboard: fixed-in-tracemonkey
I had to push out a spot fix.
http://hg.mozilla.org/mozilla-central/rev/6355d89f05dc
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Please cite the followup fix so sayrer doesn't miss it:

http://hg.mozilla.org/tracemonkey/rev/7ec985e33884

/be
Re-opening to be super-sure that Rob doesn't miss the follow-up fix which, AFAICT, has not yet been landed on mozilla-central. Apologies if it has; just want to be extra-sure.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Status: REOPENED → RESOLVED
Closed: 11 years ago11 years ago
Resolution: --- → FIXED
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/710ca7757748
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/e5fe9c68d8d3 (hotfix)

speaking of hotfixes, shouldn't we have a test case for whatever was broken?
Keywords: fixed1.9.1
This is covered by our unit tests. It lit the tinderboxes up like a Christmas tree.
Depends on: 495699
Flags: in-testsuite+
Verified fixed on trunk (20090604215922) and 1.9.1 (20090604202448) with testcase in comment 0.
Status: RESOLVED → VERIFIED
OS: Mac OS X → All
Hardware: x86 → All
Target Milestone: mozilla1.9.1 → mozilla1.9.2a1
You need to log in before you can comment on or make changes to this bug.