860435 - Crash with setTimeout, exception

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

The testcase in bug 802477 (attachment 672169 [details]) now causes a crash in Nightly.
[@ js::ion::IonFrameIterator::script].  A month ago, it was harmless in Nightly.

bp-6ff8be45-b3be-4668-9d06-1613b2130410

Comment 1

[Scoobidiver (away)]

For me: bp-fcd62d41-519b-46fb-9392-cf1172130410.

Comment 2

[Jesse Ruderman]

The DOM fuzzer is hitting this often enough to slow it down.

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed patch

I went back and forth a bit on changing the other tests of iter.done() to null-check script, but the relationship between iter.done() being true and script being non-null is pretty obvious, so I left those alone (also, changing both other occurrences left an implicit script-not-null implies iter-not-done so it wasn't that much more clear).

Comment 4

[Terrence Cole [:terrence]]

Comment on attachment 755104 [details] [diff] [review]
Proposed patch

Review of attachment 755104 [details] [diff] [review]:
-----------------------------------------------------------------

m=me

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 755104 [details] [diff] [review]
Proposed patch

https://hg.mozilla.org/integration/mozilla-inbound/rev/6b42d26c2a93

Comment 6

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/6b42d26c2a93