[ObjShrink]: Crash [@ js::HeapPtr<JSString, unsigned long>::operator] with gczeal(4)

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
5 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 2 bugs, {crash, testcase})

Other Branch
x86_64
Linux
crash, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

(Reporter)

Description

6 years ago
The following testcase crashes on jaegermonkey branch revision a335853be219 (run with -m -n -a), tested on 64 bit:


gczeal(4);
jsTestDriverEnd();
obj->setPrivate() was being used when setting an object's initial state, which could trigger a write barrier that read the previous uninitialized private value.

https://hg.mozilla.org/projects/jaegermonkey/rev/fe22ebe9b8b3
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
(Reporter)

Comment 2

5 years ago
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/2e891e0db397
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.