700464 - [ObjShrink] Crash [@ defaultValue] or [@ JS_ValueToString] or "Assertion failure: [infer failure] Missing type for arg 0: int,"

Status: RESOLVED DUPLICATE of bug 700501

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

o = [].__proto__
h = Array.prototype.__proto__
function g(o) {
    var prop = prop
    try {
        ({
            x: function() {
                return {
                    x: eval("o")
                }.x
            }
        }.x()[prop] = (6))
    } catch (e) {}
}
for (i = 0; i < 2; i++) {
    props = Object.getOwnPropertyNames({
        x: eval("o")
    }.x)
    prop = props.length ? props[props.h] + "p" : "";
    ({
        x: eval("o")
    }.x[prop] = o)
    g(h)
}
gc()
Function("{\
    function f(a) {\
        print(a)\
    }\
    for each(let b in[String]) {\
        f(b)\
    }\
}")()

asserts js debug shell on JM changeset 1210706b4576 with -m, -a and -n at Assertion failure: [infer failure] Missing type for arg 0: int, and crashes js opt shell at defaultValue.

This was found using a combination of jsfunfuzz and jandem's method fuzzer.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I've also seen possibly-related crashes at JS_ValueToString

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Not sure if this is entirely correct:

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   79348:6c7f986274b9
user:        Brian Hackett
date:        Sun Oct 30 08:27:19 2011 -0700
summary:     Fix GC hazard when constructing functions, bug 698156.

Comment 4

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 700501).