Last Comment Bug 704136 - [ObjShrink]: Crash [@ js::HeapPtr<JSString, unsigned long>::operator] with gczeal(4)
: [ObjShrink]: Crash [@ js::HeapPtr<JSString, unsigned long>::operator] with gc...
: crash, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Linux
-- critical (vote)
: ---
Assigned To: general
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: infer-regress langfuzz
  Show dependency treegraph
Reported: 2011-11-21 07:27 PST by Christian Holler (:decoder)
Modified: 2013-02-07 05:18 PST (History)
4 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Description User image Christian Holler (:decoder) 2011-11-21 07:27:08 PST
The following testcase crashes on jaegermonkey branch revision a335853be219 (run with -m -n -a), tested on 64 bit:

Comment 1 User image Brian Hackett (:bhackett) 2011-11-22 15:24:08 PST
obj->setPrivate() was being used when setting an object's initial state, which could trigger a write barrier that read the previous uninitialized private value.
Comment 2 User image Christian Holler (:decoder) 2013-02-07 05:18:43 PST
Automatically extracted testcase for this bug was committed:

Note You need to log in before you can comment on or make changes to this bug.