Closed Bug 496270 Opened 14 years ago Closed 14 years ago

TM: crash [@ js_ValueToNumber] or [@ JS_Enumerate]; corrupted array?

Categories

(Core :: JavaScript Engine, defect, P1)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
status1.9.2 --- beta4-fixed
status1.9.1 --- unaffected

People

(Reporter: jruderman, Assigned: dmandelin)

References

Details

(Keywords: crash, regression, testcase, Whiteboard: fixed-in-tracemonkey)

Crash Data

Attachments

(1 file)

Patch
1.38 KB, patch
gal
: review+
Details | Diff | Splinter Review 
+[(e = {}, (function () e)()) for each (e in ["", {}, "", {}, ""])][4];

Crash [@ js_ValueToNumber] touching 0x20000000

+[(e = {}, (function () e)()) for each (e in ["", {}, "", {}, ""])];

Crash [@ JS_Enumerate] touching 0x20000000
jit or no jit? or both?
JIT only, confirmed TM tip.
autoBisect shows this is probably related to bug 494269 :

The first bad revision is:
changeset:   28896:a16ed38ff63a
user:        David Mandelin
date:        Wed Jun 03 11:19:20 2009 -0700
summary:     Bug 494269: trace JSOP_LAMBDA_FC, r=brendan,gal
Blocks: 494269
Flags: blocking1.9.2?
Keywords: regression
Still grinding away on this. Somehow a pointer to a bogus JSObject (junk instead of actual object data) gets stored to position 3 on the trace native stack. It appears to be code generated for a JSOP_NEXTITER. No idea why this happens yet.
Attached patch Patch — — Splinter Review 
Caused by C++ semantics bustage on my part.
Assignee: general → dmandelin
Attachment #381874 - Flags: review?(gal)
Comment on attachment 381874 [details] [diff] [review]
Patch

I would prefer not to use the tracker of "in-range" checks. Its safe here accidentally.
Attachment #381874 - Flags: review?(gal) → review+
Pushed to TM as a6f9df8c33a9.
Flags: blocking1.9.2? → blocking1.9.2+
(In reply to comment #7)
> Pushed to TM as a6f9df8c33a9.

Marking `fixed-in-tracemonkey` in whiteboard.
Whiteboard: fixed-in-tracemonkey
P1.
Priority: -- → P1
http://hg.mozilla.org/mozilla-central/rev/a6f9df8c33a9
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
status1.9.1: --- → unaffected
Flags: wanted1.9.0.x-
Group: core-security
Crash Signature: [@ js_ValueToNumber] [@ JS_Enumerate]
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.