Last Comment Bug 648739 - Crash [@ JSID_TO_STRING] or [@ fun_bind] with testcase involving toString, Function.prototype.bind
: Crash [@ JSID_TO_STRING] or [@ fun_bind] with testcase involving toString, Fu...
Status: RESOLVED FIXED
: crash, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: All All
: -- critical (vote)
: ---
Assigned To: general
:
:
Mentors:
Depends on:
Blocks: jsfunfuzz 645468
  Show dependency tree / graph
 
Reported: 2011-04-09 04:03 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-19 14:06 PST (History)
7 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Attachments
stack (6.61 KB, text/plain)
2011-04-09 04:07 PDT, Gary Kwong [:gkw] [:nth10sd] 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Description Gary Kwong [:gkw] [:nth10sd] 2011-04-09 04:03:25 PDT 
(function () {
    [] = x = /x/;
    x.toString = Function.prototype.bind;
    print(x)
})()

crashes js debug and opt shell on TM changeset 6c8becdd1574 without -m nor -j.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   64672:0906d9490eaf
user:        Jeff Walden
date:        Mon Mar 28 20:01:53 2011 -0700
summary:     Bug 645468 - Remove js_TryMethod: its semantics aren't what most of its users want, and its utility is limited.  r=luke

Bug 635389 may be related, I'm filing separate because they have different regression windows.
Comment 1 Gary Kwong [:gkw] [:nth10sd] 2011-04-09 04:07:04 PDT 
Created attachment 524841 [details]
stack
Comment 2 Gary Kwong [:gkw] [:nth10sd] 2011-04-09 04:09:06 PDT 
(In reply to comment #0)
> Bug 635389 may be related, I'm filing separate because they have different
> regression windows.

The more I look at the stacks, the more I suspect this is another manifestation of bug 635389, even though that bug doesn't have .bind and this one does.

I'll leave it to others more knowledgeable to confirm this dupe.
Comment 3 Jeff Walden [:Waldo] (remove +bmo to email) 2011-04-26 12:33:22 PDT 
toString would call bind, that would throw because |this| wasn't callable, then it'd try to be helpful and stringify |this| for the error message, lather, rinse, repeat.

Fixed by bug 601709, which removed this errant stringification that's not at all part of the spec, and which also removes the possibility of recurring solely via built-in methods.
Comment 4 Christian Holler (:decoder) 2013-01-19 14:06:18 PST 
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Note You need to log in before you can comment on or make changes to this bug.