666305 - Crash [@ js_CheckForStringIndex] or [@ js::ArrayBuffer::obj_lookupProperty]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

o = (new Uint32Array).buffer
o.__proto__ = o
o.__proto__ = o

crashes js debug shell on TM changeset 0428dbdf3d58 with and without the patch in bug 665914, without any CLI arguments at js_CheckForStringIndex and crashes js opt shell at js::ArrayBuffer::obj_lookupProperty

Comment 1

[Nikhil Marathe [:nsm] (No longer reading bugmail, please needinfo?)]

0428dbdf3d58 is referring to some other changeset on TM.

The test case does fail before the patch attached to bug 665355, but raises type-error after that as it should.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #1)
> 0428dbdf3d58 is referring to some other changeset on TM.

I mean, that is the changeset which happened to be TM tip at the time of testing.

Comment 3

[Nikhil Marathe [:nsm] (No longer reading bugmail, please needinfo?)]

can you reproduce this after the set of patches that landed now? (latest is c3ceee49ac37)

Comment 4

[Asa Dotzler [:asa]]

The release team doesn't need to track this. If the JS team thinks it's important, they'll prioritize a fix and can ask for approval if that fix needs to land on branches.

Comment 5

[Sheila Mooney]

There are 2 other bugs logged with related signatures; bug 639337 and bug 591513. Did we regress the original crash or will this fix all of them.

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Nikhil Marathe from comment #3)
> can you reproduce this after the set of patches that landed now? (latest is
> c3ceee49ac37)

Nope, can't reproduce this with JM changeset e0b67d8cc908 with patch v1 from bug 672892, this has m-c merge at rev a6c87fd27ba9.

Assuming fixed by patches for bug 665355.

Comment 7

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929