Last Comment Bug 704136 - [ObjShrink]: Crash [@ js::HeapPtr<JSString, unsigned long>::operator] with gczeal(4)
: [ObjShrink]: Crash [@ js::HeapPtr<JSString, unsigned long>::operator] with gc...
Status: RESOLVED FIXED
: crash, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Linux
: -- critical (vote)
: ---
Assigned To: general
:
:
Mentors:
Depends on:
Blocks: infer-regress langfuzz
  Show dependency treegraph
 
Reported: 2011-11-21 07:27 PST by Christian Holler (:decoder)
Modified: 2013-02-07 05:18 PST (History)
4 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Christian Holler (:decoder) 2011-11-21 07:27:08 PST
The following testcase crashes on jaegermonkey branch revision a335853be219 (run with -m -n -a), tested on 64 bit:


gczeal(4);
jsTestDriverEnd();
Comment 1 Brian Hackett (:bhackett) 2011-11-22 15:24:08 PST
obj->setPrivate() was being used when setting an object's initial state, which could trigger a write barrier that read the previous uninitialized private value.

https://hg.mozilla.org/projects/jaegermonkey/rev/fe22ebe9b8b3
Comment 2 Christian Holler (:decoder) 2013-02-07 05:18:43 PST
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/2e891e0db397

Note You need to log in before you can comment on or make changes to this bug.