821470 - Crash [@ js::frontend::StrictModeGetter::get]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

Function("\
    \"use strict\";\
    const x = x = (function(){});\
")()

crashes js debug and opt shell on m-c changeset 020555b69f72 without any CLI arguments at js::frontend::StrictModeGetter::get

This seems like a null deref with strict mode, but setting fuzzblocker because it's showing up constantly in the fuzzers.

autoBisecting now..

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   115802:fa10b335dd65
user:        Benjamin Peterson
date:        Wed Dec 12 01:35:05 2012 -0500
summary:     Bug 819509 - Reparse functions if we discover they are strict. r=njn

Comment 2

[:Benjamin Peterson]

Should be fixed by bug 821103.

Comment 4

[:Benjamin Peterson]

I'm reopening this for the purpose of holding one of the patches from bug 821103, which directly fixes this.

https://hg.mozilla.org/integration/mozilla-inbound/rev/a28cfd7299e5

Comment 5

[Lukas Blakk [:lsblakk] use ?needinfo]

This doesn't look to be a serious user-facing regression or otherwise something we would block a release for, not tracking.

Comment 6

[:Benjamin Peterson]

Also, fixed now. :)

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/a28cfd7299e5

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

A type of test for this bug has already been landed because it is already marked in-testsuite+ -> VERIFIED.