Closed Bug 593583 Opened 14 years ago Closed 14 years ago

Crash [@ small_malloc_from_free_list | szone_malloc_should_clear]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 571168
Tracking Flags:
Tracking Status
blocking2.0 --- betaN+

People

(Reporter: gkw, Assigned: gal)

References

Details

(Keywords: crash, regression, testcase, Whiteboard: [sg:critical?])

Crash Data

x = wrap(Proxy.createFunction)
x.__proto__ = x;
({N: x})()

crashes js debug shell on TM changeset 60af58b42567 at small_malloc_from_free_list and crashes js opt shell at szone_malloc_should_clear
blocking2.0: --- → ?
No -m nor -j options needed.
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   42437:4dd9be00049c
user:        Andreas Gal
date:        Tue May 18 19:21:43 2010 -0700
summary:     Implement ES Harmony Proxies (bug 546590, r=mrbkap).
Blocks: harmony:proxies
Assignee: general → gal
blocking2.0: ? → betaN+
Group: core-security
Whiteboard: [sg:critical?]
sayrer, can someone else own this?
Still crashes with trunk.
Dup of bug 609287. Will keep open and close when the other one is fixed. I can keep owning this until then.
Confirmed dup.
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → DUPLICATE
Crash Signature: [@ small_malloc_from_free_list | szone_malloc_should_clear]
Group: core-security
A testcase for this bug was already added in the original bug (bug 571168).
Flags: in-testsuite-
You need to log in before you can comment on or make changes to this bug.