717497 - Crash [@ Atomize] or [@ js::ToNumberSlow] or [@ js::detail::HashTable] with E4X

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

try {
  (function() {
    XML.prettyIndent = <x><y/></x>
  })()
} catch (e) {}
print(<x><y/></x>)


crashes js opt shell on m-c changeset 7c7d2a8db7ff without any CLI arguments at Atomize with js::ToNumberSlow somewhere on the stack and crashes js debug shell at js::detail::HashTable, this should be a too much recursion crash.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Tested on 32-bit opt shell on Mac OS X Lion 10.7.2.

autoBisecting now...

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   67921:0906d9490eaf
user:        Jeff Walden
date:        Mon Mar 28 20:01:53 2011 -0700
summary:     Bug 645468 - Remove js_TryMethod: its semantics aren't what most of its users want, and its utility is limited.  r=luke

Comment 3

[Mats Palmgren (inactive)]

Atomize is currently the #2 top crash in Fx12a1.

Comment 4

[David Mandelin [:dmandelin]]

(In reply to Mats Palmgren [:mats] from comment #3)
> Atomize is currently the #2 top crash in Fx12a1.

The regressing changeset for the fuzz bug is pretty old, so I really doubt it's the cause of that topcrash.

The topcrash itself looks significant, but I also see that it was recorded only for builds on Jan 19-21. Do you think it was a temporary regression that got fixed after a couple days?

https://crash-stats.mozilla.com/report/list?version=Firefox%3A12.0a1&query_search=signature&query_type=contains&reason_type=contains&date=2012-01-29&range_value=28&range_unit=days&hang_type=any&process_type=any&signature=Atomize

Comment 5

[Mats Palmgren (inactive)]

> Do you think it was a temporary regression that got fixed after a couple days?

Yes, it looks like it a temporary spike.  It's falling and is now at #32 for Fx12.0a1

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

After bug 779215 was FIXED, this WFM, but this WFM before the bug was FIXED, though adding the options('allow_xml'); line didn't trigger the bug, but the symptoms were largely similar, and e4x is about to be removed.

-> WFM and in-testsuite- because e4x is about to be removed, no point adding the testcase.