811606 - Crash [@ JSFunction::inStrictMode] or "Assertion failure: hasScript(),"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

for each(e in [].some) {}

asserts js debug shell on m-c changeset 4e9567eeb09e without any CLI arguments at Assertion failure: hasScript(), and crashes js opt shell at JSFunction::inStrictMode

s-s due to its simplicity to be safe, even though it seems to be a null deref. Setting fuzzblocker because this is blowing up the fuzzers.

I'm pretty sure this is a recent regression - autoBisect is now running.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   113105:3da143341145
user:        Till Schneidereit
date:        Tue Aug 28 14:35:15 2012 +0200
summary:     Bug 784294 - Convert some array extras to self-hosted js implementations. r=Waldo

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Null deref = sec-moderate and csec-dos, please feel free to change this if needed.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision dd68409d7810).

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Bug 784294 was backed out in https://hg.mozilla.org/mozilla-central/rev/dd68409d7810 - "fixing" this.

Till, please add this testcase to future revised patches.

Comment 5

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 6

[Bob Clary [:bc] (inactive)]

fwiw, the assertion was hit in crash automation on windows at:

http://quizlet.com/16231061/edit/
http://www.giantbomb.com/news/worth-reading-110912/4446/
http://9gag.com/gag/5812496

It appears to have been fixed by the back out as well.

Comment 7

[Till Schneidereit [:till]]

I think we can make this public, as the causing code never made a Nightly.

Comment 8

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929