520492 - Crash [@ TraceRecorder::attemptTreeCall] - js1_6/extensions/regress-472508.js

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Bob Clary [:bc] (inactive)]

+++ This bug was initially created as a clone of Bug #520003 +++

js1_6/extensions/regress-472508.js crashed debug shell and browser in winxp only. This is another regression from bug 459301

Comment 1

[Bob Clary [:bc] (inactive)]

+		&innermostNestedGuard	0x0012eea4	VMSideExit * *
+		cx	0xdddddddd {operationCallbackFlag=??? link={...} xmlSettingFlags=??? ...}	JSContext *
+		f	0x06933a10 {first=0x06933a10 next=0x00000000 peer=0x00000000 ...}	VMFragment *
		inlineCallCount	0	unsigned int &
+		lr	0x06da5300 {block=0x00000000 pc=0x00741e5d ":" imacpc=0x06da8ada "LÿûMœ" ...}	VMSideExit *
+		this	0x06da4048 {tempAlloc={...} mark={...} cx=0xdddddddd ...}	TraceRecorder * const

js3250.dll!TraceRecorder::attemptTreeCall(VMFragment * f=0x06933a10, unsigned int & inlineCallCount=0)  Line 5985 + 0x6 bytes	C++
js3250.dll!RecordLoopEdge(JSContext * cx=0x05198530, TraceRecorder * r=0x06da4048, unsigned int & inlineCallCount=0)  Line 5948 + 0x10 bytes	C++
js3250.dll!js_MonitorLoopEdge(JSContext * cx=0x05198530, unsigned int & inlineCallCount=0, MonitorReason reason=Monitor_Branch)  Line 6796 + 0x14 bytes	C++

mmm, deleted memory.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Good catch. Bug here is that I forgot to save |this->cx| when |this| can be destroyed.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

jsfunfuzz has also been hitting this issue...

Comment 4

[Andreas Gal :gal]

Comment on attachment 404669 [details] [diff] [review]
fix

Please use a comment or maybe localCx.

Comment 5

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/tracemonkey/rev/7f14152ae76f

pushed, renamed _cx to localCx.

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/7f14152ae76f

Comment 7

[Bob Clary [:bc] (inactive)]

v 1.9.3