842482 - Crash with array buffer from other global

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Attachment: stack

var g = newGlobal();
new g.DataView(new g.ArrayBuffer());

The first bad revision is:
changeset:   5ddd827d87ec
user:        Terrence Cole
date:        Tue Feb 12 11:50:49 2013 -0800
summary:     Bug 839215 - Make large typedarrays singletons more aggressively; r=bhackett

Comment 1

[Jesse Ruderman]

Attachment: browser testcase (crashes Firefox when loaded)

Comment 2

[Jesse Ruderman]

bp-87414cc9-6485-46e0-9bc7-a2bcf2130219

Comment 3

[bhavana bajaj [:bajaj]]

Passing on to Terrence as this may be a fallout from 839215 per description . Please feel free to reassign if needed.

Comment 4

[Terrence Cole [:terrence]]

Attachment: v0

Comment 5

[Terrence Cole [:terrence]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/5bb4e4ea6977

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/5bb4e4ea6977

Comment 7

[Terrence Cole [:terrence]]

Comment on attachment 717941 [details] [diff] [review]
v0

[Approval Request Comment]
Bug caused by (feature/regressing bug #): Bug 839215
User impact if declined: Crash on cross-global typedarray creation.
Testing completed (on m-c, etc.): Fuzz test checked into mozilla-inbound.
Risk to taking this patch (and alternatives if risky): Zero. This is a trivial crash fix.
String or UUID changes made by this patch: None.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/e162659d1a93