837418 - Crash [@ JS::Handle<JSString*>::operator->] or [@ JSString::isAtom]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

x = 'x';
for (var m = 0; m < 99; ++m) {
    x = x.concat(x);
}

crashes js debug shell on m-c changeset be76182b91a6 without any CLI arguments at JSString::isAtom and crashes js opt shell at JS::Handle<JSString*>::operator->

s-s and assuming sec-critical because weird memory address 0x8000000 seems to be being accessed.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   119956:052d2de29f8f
user:        Brian Hackett
date:        Sat Jan 26 07:42:20 2013 -0700
summary:     Bug 834826 - Eliminate or refactor various unnecessary stack roots, r=terrence.

Comment 1

[Brian Hackett [Laid off!]]

Attachment: patch

Silly mistake leading to a NULL crash.

Comment 2

[Brian Hackett [Laid off!]]

NULL deref, not s-s.

Comment 3

[Christian Holler (:decoder)]

Not sec-critical either.

Comment 4

[Terrence Cole [:terrence]]

Comment on attachment 709486 [details] [diff] [review]
patch

Review of attachment 709486 [details] [diff] [review]:
-----------------------------------------------------------------

Wow, yeah, that's a total facepalm: I should have seen that when reviewing.

Comment 5

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/bf21c968fa89

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/bf21c968fa89