Closed
Bug 683966
Opened 13 years ago
Closed 13 years ago
Crash with testcase on Windows 7 involving gc
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: crash, testcase, Whiteboard: fixed-in-jaegermonkey)
Attachments
(2 files)
|
1.39 KB,
text/plain
|
Details | |
|
818 bytes,
patch
|
jorendorff
:
review+
|
Details | Diff | Splinter Review |
Attached ~50-line testcase crashes js debug shell on m-c changeset 7d3d1c2c75f8 with -m, -a and -d. Because it's on Windows, I don't yet have a stack.
Since this involves gc, I'm locking just-in-case, as per normal.
This was found using a triple combination of an existing js test, jsfunfuzz and jandem's method fuzzer.
|
||
Comment 1•13 years ago
|
||
The fix for bug 679461 was disabled when bug 674251 landed. This is a better fix, closer to the problem --- the debugger shouldn't try to recompile scripts during GC.
Attachment #557977 -
Flags: review?(jorendorff)
|
|
||
Comment 2•13 years ago
|
||
Whiteboard: js-triage-needed → fixed-in-jaegermonkey
|
||
Comment 3•13 years ago
|
||
Comment on attachment 557977 [details] [diff] [review]
patch
Sure, ok.
The comment might be too confident--are we really sure the script is necessarily being destroyed? Perhaps something else is being GC'd and we are calling JS_ClearTrap from a finalize hook.
Skipping recompilation is harmless in any case.
Attachment #557977 -
Flags: review?(jorendorff) → review+
|
|
||
Comment 4•13 years ago
|
||
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
|
||
Updated•10 years ago
|
Group: core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•