Closed Bug 877378 Opened 9 years ago Closed 9 years ago

Compartment mismatch crash involving saveFrameChain

Categories

(Core :: JavaScript Engine, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla24

People

(Reporter: gkw, Assigned: jandem)

References

Details

(Keywords: crash, regression, testcase, Whiteboard: [jsbugmon:update])

Crash Data

Attachments

(2 files)

Attached file stack
evalcx("\
    let z = 0;\
    z += 'x';\
    for (var v of z) {\
        y = evaluate(\"Object.defineProperty(this,\\\"y\\\",{ \
                            get:  function() {} \
                        } );\", { \
                            catchTermination: true,\
                            saveFrameChain: true\
                        }\
                    );\
        }",
    newGlobal('')
)

crashes js debug shell on m-c changeset 8d85de779506 without any CLI arguments at js::CompartmentChecker::fail (*** Compartment mismatch 0x101850400 vs. 0x101843c00 shown)

This testcase was previously filed as bug 876226 comment 8. Can all the testcases in that bug please be added to the testsuite?

(assuming also related to bug 875473)
Flags: needinfo?(jdemooij)
Duplicate of this bug: 877381
Attached patch PatchSplinter Review
Saving/restoring the frame chain can switch compartments, so we have to restore it before calling JS_WrapValue.
Assignee: general → jdemooij
Status: NEW → ASSIGNED
Attachment #756474 - Flags: review?(luke)
Flags: needinfo?(jdemooij)
Attachment #756474 - Flags: review?(luke) → review+
https://hg.mozilla.org/mozilla-central/rev/1c4403cbda57
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla24
(In reply to Ed Morley [:edmorley UTC+1] from comment #5)
> https://hg.mozilla.org/mozilla-central/rev/71f2968c7359

It seems that I made a mistake when writing the bug number in the commit message. This last push was actually for bug 877338. Sorry for the inconvenience.
You need to log in before you can comment on or make changes to this bug.