849456 - Crash [@ DeflateStringToUTF8Buffer] or [@ JS::TwoByteCharsToNewUTF8CharsZ] with --enable-more-deterministic

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stacks

s = newGlobal('');
function f(code) {
    try {
        evalcx(code, s)
    } catch (e) {
        print(' ' + e);
    }
}
f("\
    m = this;\
    m.valueOf = (function(){});\
    m += 'xxxx';\
    for(let y = 0; y < 999;y++) {\
        m += m\
    };\
");
f("Object.preventExtensions(m);")

crashes js debug and opt shell on m-c changeset 0e7639e3bdfb with --no-ti --no-ion -a at DeflateStringToUTF8Buffer with JS::TwoByteCharsToNewUTF8CharsZ on the stack.

Setting this as s-s even though it seems to be a null deref in deterministic builds, because the crash signatures scare me.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   122625:5d8a1621a697
user:        Chuck Lee
date:        Fri Feb 22 10:58:52 2013 +0800
summary:     Bug 835719 - 0001. Support encode string to UTF-8 byte array. r=terrence

Comment 1

[Terrence Cole [:terrence]]

Attachment: v0

This is a trivial NULL deref. This is fallout from a B2G fix, so should probably be uplifted to b2g18.

Comment 2

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/edf62f27b3c0

Comment 3

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/edf62f27b3c0

Comment 4

[Andrew McCreight [:mccr8]]

Terrence, can this be unhidden because it is just a null crash all the time?

Comment 5

[Terrence Cole [:terrence]]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #3)
> https://hg.mozilla.org/mozilla-central/rev/edf62f27b3c0

There's not any point adding a test for this.

(In reply to Andrew McCreight [:mccr8] from comment #4)
> Terrence, can this be unhidden because it is just a null crash all the time?

I'm not sure what the rules are, but it's fine by me.

Comment 6

[Chuck Lee [:chucklee, Triggered by NI, Review, and Feedback requests]]

This bug is caused by my patch in Bug 835719.
It's not uplift to b2g18, thanks for fixing it!