543436 - Crash [@ JSFunctionBox::joinable] or [@ JSCompiler::setFunctionKinds]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function() {
  try {
    eval("\
      function() {\
        if (3)\
        (1 for (x in []));\
        else \
        (this._ = function(){})\
      }\
    ");
  } catch(e) {}
})()


crashes js debug shell on TM tip without -j at JSFunctionBox::joinable near null and crashes js opt shell on TM tip without -j at JSCompiler::setFunctionKinds near null.

autoBisect shows this is probably related to bug 536564:

The first bad revision is:
changeset:   37039:f6b37dc8709e
user:        Brendan Eich
date:        Thu Jan 14 14:22:00 2010 -0800
summary:     Fast followup fix for thinko (536564, r=jorendorff).

===

js opt shell stacktrace:

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000008
Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   js-opt-32-tm-darwin           	0x0008f64d JSCompiler::setFunctionKinds(JSFunctionBox*, unsigned int&) + 429
1   js-opt-32-tm-darwin           	0x000a2b7b JSCompiler::compileScript(JSContext*, JSObject*, JSStackFrame*, JSPrincipals*, unsigned int, unsigned short const*, unsigned long, __sFILE*, char const*, unsigned int, JSString*, unsigned int) + 955
2   js-opt-32-tm-darwin           	0x0007367a obj_eval(JSContext*, JSObject*, unsigned int, long*, long*) + 2362
3   js-opt-32-tm-darwin           	0x0005f8ac js_Invoke + 1180
4   js-opt-32-tm-darwin           	0x0005540f js_Interpret + 25007
5   js-opt-32-tm-darwin           	0x0005f0c1 js_Execute + 625
6   js-opt-32-tm-darwin           	0x0000debc JS_ExecuteScript + 60
7   js-opt-32-tm-darwin           	0x00004c28 Process(JSContext*, JSObject*, char*, int) + 1336
8   js-opt-32-tm-darwin           	0x00008ca6 main + 1734
9   js-opt-32-tm-darwin           	0x00002bcd _start + 208
10  js-opt-32-tm-darwin           	0x00002afc start + 40

Comment 1

[Brendan Eich [:brendan]]

Attachment: fix

D'oh.

/be

Comment 2

[Brendan Eich [:brendan]]

Thanks, Gary -- could not do it without your fuzzing efforts.

/be

Comment 3

[Brendan Eich [:brendan]]

Attachment: fix, v2

I had this patch originally, and then "simplified" too much without running trace-test. Writing "I will not [do that again]" 100x on the blackboard...

/be

Comment 4

[Brendan Eich [:brendan]]

Gotta keep the fuzzer happy.

http://hg.mozilla.org/tracemonkey/rev/61d3e2eec985

/be

Comment 5

[Brendan Eich [:brendan]]

Rats, wrong words in commit message, right bug number. See bug 546069.

/be

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/61d3e2eec985

Comment 7

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929