527261 - tests/js/jsd/test/test_bug507448.html test failure/crash after patch for 525481 landed [@fun_reserveSlots ]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Brendan Eich [:brendan]]

80 ERROR TEST-UNEXPECTED-FAIL | /tests/js/jsd/test/test_bug507448.html |
[SimpleTest/SimpleTest.js, window.onerror] An error occurred -
jsd.wrapValue(f).script is null at
http://localhost:8888/tests/js/jsd/test/test_bug507448.html:54
TEST-UNEXPECTED-FAIL | automation.py | Exited with code -1073741819 during test
run
TEST-UNEXPECTED-FAIL | automation.py | application crashed (minidump found)
TEST-UNEXPECTED-FAIL | automationutils.processLeakLog() | missing output line
for total leaks!

Comment 1

[Robert Sayre]

Attachment: crash stack

Comment 2

[Brendan Eich [:brendan]]

Attachment: fix

The empty script optimization could fail due to debugger hooks, and if the script was being constructed by js_NewScriptFromCG then we'd leave fun->u.i.script NULL!

Worse, making a mutable empty script should have gone through the newScriptHook as usual. Fixing that consisted in letting the normal code in js_NewScriptFromCG create the mutable empty script, so the net patch for this bug and the one it blocks is smaller.

Good test, wish we could run it in the shell (xpc or js).

/be

Comment 3

[Bill Gianopoulos [:WG9s]]

This also causes the browser to crash when you load Dom Inspector.

Comment 4

[Brendan Eich [:brendan]]

http://hg.mozilla.org/tracemonkey/rev/e5c0a6d8be25

Thanks to sayrer for landing this. It needs to go into m-c too.

/be

Comment 5

[Bill Gianopoulos [:WG9s]]

I have verified that the patch here fixes the Mozilla Central Dom Inspector crash I mentioned in comment #3.

Comment 6

[Robert Sayre]

landed on mozilla-central as well.

http://hg.mozilla.org/mozilla-central/rev/499a3c1f0001

Comment 8

[Robert Sayre]

hmm, looks like this may be causing Windows leak test boxes to assert on startup. bah humbug.

Comment 10

[Henrik Skupin (:whimboo) [⌚️UTC+2]]

Looks good in a tinderbox build. Will check again once we have new nightly builds.

Comment 11

[linuser]

The latest nightly build doesn't crash anymore when FlashGot is installed ( https://bugzilla.mozilla.org/show_bug.cgi?id=527399 )

Comment 12

[Henrik Skupin (:whimboo) [⌚️UTC+2]]

The crash on OS X has gone too. Marking verified fixed with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.3a1pre) Gecko/20091109 Minefield/3.7a1pre ID:20091109034249

Comment 13

[[e-mail]]

Fixed for me.

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.3a1pre) Gecko/20091109 Minefield/3.7a1pre (.NET CLR 3.5.30729) ID:20091109043812

Comment 14

[Brendan Eich [:brendan]]

(In reply to comment #8)
> hmm, looks like this may be causing Windows leak test boxes to assert on
> startup. bah humbug.

Need some help debugging -- anyone able to reproduce under VS?

New bug blocking this one, at this point.

/be

Comment 15

[Robert Sayre]

bug 527894