Closed Bug 1139792 Opened 10 years ago Closed 10 years ago

Intermittent basic/testDenseToSlowArray.js | js(21874,0x101e87000) malloc: *** error for object 0x5a5a5a5a5a5a5a5a: pointer being freed was not allocated (code -6, args "--ion-eager --ion-offthread-compile=off")

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1140773

People

(Reporter: cbook, Unassigned)

References

(
URL
)

Details

(Keywords: csectype-uaf, intermittent-failure, sec-high)

Rev4 MacOSX Snow Leopard 10.6 mozilla-inbound debug test jittest https://treeherder.mozilla.org/logviewer.html#?job_id=7234078&repo=mozilla-inbound 21:52:08 WARNING - TEST-UNEXPECTED-FAIL | tests/jit-test/jit-test/tests/basic/testDenseToSlowArray.js | js(21874,0x101e87000) malloc: *** error for object 0x5a5a5a5a5a5a5a5a: pointer being freed was not allocated (code -6, args "--ion-eager --ion-offthread-compile=off")
This looks bad. Unfortunately I can't repro it locally when I run this test with "--ion-eager --ion-offthread-compile=off" (5000 runs later). Will try to download the shell build from treeherder and see if that one works.
See Also: → 1140655
Likely a duplicate of bug 1140773. The symptoms are very similar, a GC race condition could explain why this crashed intermittently and this started a day after bug 1122640 landed.
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → DUPLICATE
Group: core-security → core-security-release
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.