972961 - Crash [@ js::frontend::ParseNode::getKind] with over-recursion through [@ ContainsVarOrConst]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 6687d299c464 (threadsafe build, run with --fuzzing-safe):


eval('if (null) {' + Array(0xdbaa).join(("a.b.c")) + '}');

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 3

[Jason Orendorff [:jorendorff]]

Constant folding is overflowing the stack doing a recursive walk of the AST.

Comment 4

[Jason Orendorff [:jorendorff]]

Attachment: bug-972961-recursion-v1.patch

straightforward fix, devious test

Comment 5

[Luke Wagner [:luke]]

Comment on attachment 8377684 [details] [diff] [review]
bug-972961-recursion-v1.patch

That is quite a test, there.

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Just wondering, is this ready for landing?

Comment 7

[Jason Orendorff [:jorendorff]]

I have a stack of random stuff to land.

One last Try server test is respinning: https://tbpl.mozilla.org/?tree=Try&rev=711af7610af3

Comment 8

[Jason Orendorff [:jorendorff]]

Windows didn't like the test. I put a cap on the stack depth to avoid timing out.

https://hg.mozilla.org/integration/mozilla-inbound/rev/236e257bf505

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/236e257bf505