(function() { try { eval("\ function() {\ if (3)\ (1 for (x in []));\ else \ (this._ = function(){})\ }\ "); } catch(e) {} })() crashes js debug shell on TM tip without -j at JSFunctionBox::joinable near null and crashes js opt shell on TM tip without -j at JSCompiler::setFunctionKinds near null. autoBisect shows this is probably related to bug 536564: The first bad revision is: changeset: 37039:f6b37dc8709e user: Brendan Eich date: Thu Jan 14 14:22:00 2010 -0800 summary: Fast followup fix for thinko (536564, r=jorendorff). === js opt shell stacktrace: Exception Type: EXC_BAD_ACCESS (SIGBUS) Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000008 Crashed Thread: 0 Dispatch queue: com.apple.main-thread Thread 0 Crashed: Dispatch queue: com.apple.main-thread 0 js-opt-32-tm-darwin 0x0008f64d JSCompiler::setFunctionKinds(JSFunctionBox*, unsigned int&) + 429 1 js-opt-32-tm-darwin 0x000a2b7b JSCompiler::compileScript(JSContext*, JSObject*, JSStackFrame*, JSPrincipals*, unsigned int, unsigned short const*, unsigned long, __sFILE*, char const*, unsigned int, JSString*, unsigned int) + 955 2 js-opt-32-tm-darwin 0x0007367a obj_eval(JSContext*, JSObject*, unsigned int, long*, long*) + 2362 3 js-opt-32-tm-darwin 0x0005f8ac js_Invoke + 1180 4 js-opt-32-tm-darwin 0x0005540f js_Interpret + 25007 5 js-opt-32-tm-darwin 0x0005f0c1 js_Execute + 625 6 js-opt-32-tm-darwin 0x0000debc JS_ExecuteScript + 60 7 js-opt-32-tm-darwin 0x00004c28 Process(JSContext*, JSObject*, char*, int) + 1336 8 js-opt-32-tm-darwin 0x00008ca6 main + 1734 9 js-opt-32-tm-darwin 0x00002bcd _start + 208 10 js-opt-32-tm-darwin 0x00002afc start + 40

D'oh. /be

Thanks, Gary -- could not do it without your fuzzing efforts. /be

I had this patch originally, and then "simplified" too much without running trace-test. Writing "I will not [do that again]" 100x on the blackboard... /be

Gotta keep the fuzzer happy. http://hg.mozilla.org/tracemonkey/rev/61d3e2eec985 /be

Rats, wrong words in commit message, right bug number. See bug 546069. /be

Automatically extracted testcase for this bug was committed: https://hg.mozilla.org/mozilla-central/rev/efaf8960a929