647694 - TI: Crash [@ js::mjit::EnterMethodJIT] or [@ js::mjit::ic::GetGlobalName] with ArrayBuffer, eval, try...catch

Status: RESOLVED DUPLICATE of bug 646267

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function z(f) {
    try {
        f()
    } catch(r) {
        if (e) {}
    }
}
function g(code) {
    var f = eval("(function(){" + code + "})")
    z(f)
}
g()
g()
g()
g("\
  this.bb::h=ArrayBuffer();\
  function bb(){let(n)*}\
")

crashes js debug shell on JM changeset a58525f1f4be with -m, -a and -n at js::mjit::EnterMethodJIT

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Tested on 64-bit.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function h(code) {
    try {
        f = g2("(function(){" + code + "})")
    } catch(r) {} {
        g(f, code)
    }
}
function g2(s) {
    return eval(s)
}
function g() {
    try {
        f()
        if (a) {}
    } catch(r) {
        g()
    }
}
a = 0
for (var x in 0) {}
h("")
h("")
h("{b=x}");
h("this.b::b=Math")

is a 32-bit testcase that crashes similarly in debug but also crashes at js::mjit::ic::GetGlobalName in opt.

Comment 4

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 646267).