583402 - JM: crashtest crash on dom/base/crashtests/499006-1.html

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Comment 1

[David Mandelin [:dmandelin]]

There was a loop in js_ClearScope that uses unsigned in a bad way.

http://hg.mozilla.org/projects/jaegermonkey/rev/fbbb0c6655c9

Comment 2

[Brendan Eich [:brendan]]

What was n, and what was i's initial value?

/be

Comment 3

[David Mandelin [:dmandelin]]

I don't remember about i, but n was 0.

Comment 4

[Brendan Eich [:brendan]]

Freakshow -- n shouldn't be 0 (yet; bug 558451 will change things; maybe JM has already, but I would like to know how/why).

We use unsigned types even with count down loops so long as boundary conditions allow. An assertion was due here, though, that n != 0. Sorry about that!

/be

Comment 5

[David Mandelin [:dmandelin]]

(In reply to comment #4)
> Freakshow -- n shouldn't be 0 (yet; bug 558451 will change things; maybe JM has
> already, but I would like to know how/why).

We are currently in sync with a version of TM after parent was made into a member but before that patch was backed out.

> We use unsigned types even with count down loops so long as boundary conditions
> allow. An assertion was due here, though, that n != 0. Sorry about that!

The bug probably got caught more easily this way, since we are heavily focused on crashes right now in JM.

Comment 6

[Brendan Eich [:brendan]]

This raises a good point: the patch to make parent a typed member not an fslot should have assertions added to it, probably. Inspection of uint32 type usage for sure.

/be