Bugzilla@Mozilla – Bug 475971
js_CheckRedeclaration does not always unlock object on failures
Last modified: 2009-10-14 16:40:45 PDT
Summon comment box
The contract for js_CheckRedeclaration is to always call OBJ_DROP_PROPERTY on failures. But this does not happen when the caller passes non-null objp/propp. For objects shared between threads this leads to unbalanced js_(Lock/Unlock)Object. The example below demonstrates this. Currently it hangs when run in a thread-safe shell. Note this probably is not reproducible in the browser as even with thread workers no objects should be shared between threads. function x() { return 1; }; // g must run sufficiently long to ensure that the global scope is accessed // from the parallel threads. function g() { var sum = 0; try { for (var i = 0; i != 10000; ++i) { sum += x(); } } catch (e) { } } scatter([g, g]); try { eval("const x = 1"); } catch (e) { } scatter([g, g]); print("Done");
The fix for the bug 476049 has landed in TM and it also fixes this issue.
Nominating for 1.9.0
The fix for the bug 476049 has landed in mozilla-central and it also fixes this issue.
Created attachment 362941 [details] js1_8/extensions/regress-475971.js
fixed for 1.9.0 as the fix for bug 476049 is landed on this branch
Regarding sg:critical - this bug itself is not critical. The reason that the patch for bug 476049 included the fix was that it was easy to make the patch there that would fix this bug rather than not.
Verified for 1.9.0.9 as bug 476049 has been verified for 1.9.0.9. Bob, I don't suppose that this test could be added to the 1.9.0 test runs?
Al, it has been although it is not checked in since it is sensitive. No need to verify js bugs that have in-testsuite+ marked since I'll do them.
All right. I'm just trying to make sure 1.9.0.9 bugs are verified by today since we make builds on Monday and I'd hate to find out that we didn't fix something AFTER we have official builds.
k.
bob: test checked in?
no, not yet.
shouldn't this be "in-testsuite -" then?
No. It has a test attached to the bug and that will be checked in shortly.
hi bob. did it get checked in?
js1_8/extensions/regress-475971.js http://hg.mozilla.org/tracemonkey/rev/b399794774c4
/cvsroot/mozilla/js/tests/js1_8/extensions/regress-475971.js,v <-- regress-475971.js initial revision: 1.1
v no crashes with 1.9.1, 1.9.2, 1.9.3