849777 - Crash [@ js::frontend::TokenStream::reportCompileErrorNumberVA]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

Attachment: Testcase for shell

The attached testcase crashes on mozilla-central revision eccf45749400 (no options required).

Comment 1

[Christian Holler (:decoder)]

Crash trace:

==11377== Invalid read of size 4
==11377==    at 0x859B596: js::frontend::TokenStream::reportCompileErrorNumberVA(js::frontend::TokenPos const&, unsigned int, unsigned int, char*) (TokenStream.cpp:510)
==11377==    by 0x8507278: js::frontend::BytecodeEmitter::reportError(js::frontend::ParseNode*, unsigned int, ...) (BytecodeEmitter.cpp:1669)
==11377==    by 0x8352C27: JSScript::fullyInitFromEmitter(JSContext*, JS::Handle<JSScript*>, js::frontend::BytecodeEmitter*) (jsscript.cpp:1889)
==11377==    by 0x84F6833: js::frontend::CompileScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::CompileOptions const&, unsigned short const*, unsigned int, JSString*, unsigned int, js::SourceCompressionToken*) (BytecodeCompiler.cpp:265)
==11377==    by 0x85B17AF: EvalKernel(JSContext*, JS::CallArgs const&, EvalType, js::AbstractFramePtr, JS::Handle<JSObject*>) (Eval.cpp:297)
==11377==    by 0x85B2EA4: js::DirectEval(JSContext*, JS::CallArgs const&) (Eval.cpp:421)
==11377==    by 0x873346A: js::mjit::stubs::Eval(js::VMFrame&, unsigned int) (InvokeHelpers.cpp:469)
==11377==    by 0x95198BB: ???
==11377==    by 0x8C9DFF3: ??? (in /srv/repos/mozilla-central/js/src/debug32/shell/js)
==11377==  Address 0x8 is not stack'd, malloc'd or (recently) free'd

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   123020:c92816f3028c
user:        Brian Hackett
date:        Tue Feb 26 08:41:57 2013 -0700
summary:     Bug 835587 - Add syntax only mode to parser, r=jorendorff.

This iteration took 114.940 seconds to run.

Comment 3

[Christian Holler (:decoder)]

Brian, can you take a look based on comment 2? Thanks.

Comment 4

[Brian Hackett [Laid off!]]

Attachment: patch

Errors reported via the bytecode emitter weren't null checking properly.

Comment 5

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1a2842ef5b71

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/1a2842ef5b71