678234 - TI: Crash [@ GetValueType]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

a = {}
function f(o) {
    for (x in o) {
        print
    }
}
for (var i = 0; i < 3; i++) {
    new f(a)
    a.__proto__ = null
}

crashes js opt shell on JM changeset e0b67d8cc908 with -m, -a and -n and patch v1 from bug 672892 at GetValueType.

May be similar to bug 678141.

Comment 1

[Brian Hackett [Laid off!]]

This is a similar issue to bug 678141, but not the same issue.  The FrameState treated 'this' values in constructors as dead if 'this' was not explicitly accessed later in the script, and unsynced 'this' values could be be dropped as a result, leading to a garbage value being returned by the function.  The fix treats 'this' values as always being live when doing regalloc for constructor frames.

http://hg.mozilla.org/projects/jaegermonkey/rev/07361922fd67

Comment 2

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug678234.js.