567606 - Crash [@ js_NativeGet] or [@ js_GetPropertyHelper]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function() {
    function f() {
        this.b = function() {};
        Object.defineProperty(this, "b", ({
            configurable: __defineSetter__("", function() {})
        }))
    }
    for each(y in [0]) {
        _ = new f()
    }
})()
uneval(this)

crashes js debug shell on TM tip without -j at js_NativeGet and crashes js opt shell on TM tip without -j at js_GetPropertyHelper at a weird memory address. (s-s and assuming [sg:critical?] because of this)

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000101208540
Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   ???                           	0x0000000101208540 0 + 4313875776
1   js-opt-64-tm-darwin           	0x000000010007493d js_GetPropertyHelper + 253
2   js-opt-64-tm-darwin           	0x000000010006fec8 MarkSharpObjects(JSContext*, JSObject*, JSIdArray**) + 728
3   js-opt-64-tm-darwin           	0x000000010006fee6 MarkSharpObjects(JSContext*, JSObject*, JSIdArray**) + 758
4   js-opt-64-tm-darwin           	0x000000010007009c js_EnterSharpObject + 348
5   js-opt-64-tm-darwin           	0x0000000100070e43 obj_toSource(JSContext*, unsigned int, long*) + 291
6   js-opt-64-tm-darwin           	0x00000001000645fa js_Invoke + 234
7   js-opt-64-tm-darwin           	0x0000000100065280 js_InternalInvoke + 240
8   js-opt-64-tm-darwin           	0x0000000100074e2d js_TryMethod + 349
9   js-opt-64-tm-darwin           	0x00000001000e6100 js_ValueToSource + 400
10  js-opt-64-tm-darwin           	0x00000001000e6171 str_uneval(JSContext*, unsigned int, long*) + 33
11  js-opt-64-tm-darwin           	0x000000010005cb00 js_Interpret + 40160
12  js-opt-64-tm-darwin           	0x00000001000640b5 js_Execute + 581
13  js-opt-64-tm-darwin           	0x000000010000d1c0 JS_ExecuteScript + 32
14  js-opt-64-tm-darwin           	0x00000001000033e7 Process(JSContext*, JSObject*, char*, int) + 1191
15  js-opt-64-tm-darwin           	0x0000000100006ffd main + 1341
16  js-opt-64-tm-darwin           	0x0000000100001236 _start + 224
17  js-opt-64-tm-darwin           	0x0000000100001155 start + 33

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to bug 430133:

The first bad revision is:
changeset:   36651:766a6b2e74e7
user:        Jeff Walden
date:        Fri Jun 05 12:56:45 2009 -0700
summary:     Bug 430133 - Implement ES3.1's Object.defineProperty and
Object.defineProperties.  r=jorendorff

Comment 2

[Brendan Eich [:brendan]]

Attachment: proposed fix

I should have caught this when doing the patch for bug 560796. I checked all the />getter(/ matches -- some wanted the method because they used sprop->getFlags() along with the raw getter to define a property with the same method, getter, or setter status, using one generic call.

/be

Comment 3

[Jeff Walden [:Waldo]]

Comment on attachment 447050 [details] [diff] [review]
proposed fix

r=me with a test added at the same time

Comment 4

[Brendan Eich [:brendan]]

http://hg.mozilla.org/tracemonkey/rev/3aec4f836bb5

/be

Comment 5

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/3aec4f836bb5

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Test committed with fix, marking verified based on that.