643243 - TI: Crash [@ js::PutEscapedStringImpl] or [@ js::types::CondenseSweepTypeSet]

Status: RESOLVED DUPLICATE of bug 643284

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

{
    function newSandbox(n) {}
}
var o12 = Float32Array.prototype;
function f12(o) {
    eval('o')['__proto_' + '_'] = null;
}
for (var i = 0; i < 14; i++) {
    gc()
    new f12(o12);
}


crashes js debug shells on JM changeset 5ce2f7a90286 with -m, -a and -n at js::PutEscapedStringImpl and crashes js opt shells at js::types::CondenseSweepTypeSet when passed in as a CLI argument.

This was found using a combination of jsfunfuzz and jandem's method fuzzer.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

Comment 3

[Brian Hackett [Laid off!]]

Same GC corruption as bug 643284, will push the testcase.

Comment 4

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug643243.js.