465686 - TM: double free and crash [@ tiny_free_list_add_ptr]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

for each (let b in [eval, eval, 4, 4]) { 
  ++b; 
  for each (b in [(void 0), (void 0), (void 0), 3, (void 0), 3]) { 
    b ^= b; 
    for each (var c in [1/0]) {
    }
  } 
}

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: proposed fix

Can't trash tree with live recorder.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Pushed fix as changeset http://hg.mozilla.org/tracemonkey/rev/c8d272272215

Comment 3

[Bob Clary [:bc] (inactive)]

Attachment: js1_7/regress/regress-465686.js

Comment 4

[Bob Clary [:bc] (inactive)]

this is fixed on tracemonkey but not mozilla-central or mozilla-1.9.1

Comment 5

[Robert Sayre]

Fixed on central and 1.9.1.

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/3f171689eeb8

bc, what about getting the test on 1.9.1?

Comment 6

[Bob Clary [:bc] (inactive)]

rob, we don't commit sensitive tests until they are made public. tomcat and i are both running this test privately around the clock on windows, linux and mac for all branches. I'll get caught up on verifications this weekend.

Comment 7

[Bob Clary [:bc] (inactive)]

v 1.9.1, 1.9.2

Comment 8

[Bob Clary [:bc] (inactive)]

test checked into 1.9.0, 1.9.1, 1.9.2, tracemonkey. 1.9.3 will get picked up in the next merge.