563127 - TM: Crash [@ js_GetCurrentBytecodePC] with evalcx

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

function a() {}
a();
for(var j=0;j<3;++j){ evalcx("lazy");}

Comment 1

[Jesse Ruderman]

Attachment: stack trace from mac

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(gdb) x/i $eip
0x21c69 <_Z23js_GetCurrentBytecodePCP9JSContext+25>:    mov    0x14(%eax),%edx
(gdb) x/1b $eax
0x0:    Cannot access memory at address 0x0

This seems to be a null +14 dereference.

Comment 3

[Andreas Gal :gal]

I don't think this can happen inside the browser from content, so I will leave this open for now.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to bug 551680:

The first bad revision is:
changeset:   39494:eba4f78cdca4
user:        Igor Bukanov
date:        Wed Mar 17 10:29:37 2010 +0300
summary:     bug 551680 - replacing JS_(Suspend|Resume)Request with JSAutoSuspendRequest. r=mrbkap

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This crash is now flooding jsfunfuzz. Urgh.

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   44269:3aaaa21012c8
user:        Jason Orendorff
date:        Wed Jun 23 16:35:10 2010 -0500
summary:     Bug 563099 - Compartments and wrappers API. r=gal.

Bug 563099 seems to have fixed the assert.

Comment 7

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929