523530 - Crash [@ 0x001f5422] or [@ 0x002dd7e1]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

try { (function() {
    [__defineSetter__("x", gc)]
    })()
} catch(e) {}
try { (function() {
        __defineGetter__("x", gc).x
    })()
} catch(e) {}
try { (function() {
        for (var a = 0; a < 8; ++a) {
            if (a % 3 == 1) {
                this.watch("x", eval)
            }
        }
    })()
} catch(e) {}
try { (function() {
        for (let b = 0; b < 4; ++b) print(x = 3 / 0)
    })()
} catch(e) {}


crashes js opt shell without -j at 0x001f5422 and crashes dbg shell without -j at 0x002dd7e1 when passed in as a CLI argument. Setting security-sensitive due to scary addresses. autoBisect coming right up...

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Strangely, gdb fails to unwind, but mac os x crash reporter has little trouble.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: the original dbg and opt stacktraces from Crash Reporter.app

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to bug 495325:

The first bad revision is:
changeset:   33133:de72243414cd
user:        Blake Kaplan
date:        Mon Aug 17 18:08:20 2009 -0700
summary:     Bug 495325 - Follow ES about indirect eval being global eval. r=brendan/igor

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

When we set aside the scope chain, it isn't marked any more. We need to do that manually. I wanted to use JSAutoTempValueRooter, but couldn't see an easy way to do so.

Comment 5

[Brendan Eich [:brendan]]

Comment on attachment 407469 [details] [diff] [review]
Fix

So to use JSAutoTempValueRooters you'd need to get rid of the downward gotos, or else init the atvrs with null and then set their values?

/be

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/tracemonkey/rev/2581d8d91679

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This was pushed to mozilla-central some time ago:

http://hg.mozilla.org/mozilla-central/rev/2581d8d91679

Apparently in the checkin message a different number, bug 520511 was referenced.