[IncrementalGC] Crash [@ IteratorNext [inlined]] or "Assertion failure: !aheader->hasFreeThings(),"

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: gkw, Assigned: billm)

Tracking

(Blocks: 1 bug, 4 keywords)

Other Branch
x86_64
Mac OS X
assertion, crash, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
Created attachment 579147 [details]
stacks

RegExp.prototype.__proto__[2] = 2
Function("\
  for(z in[0]) {\
    for(e in ((ArrayBuffer)(725485439)))\
      print\
  }\
")()

asserts js debug shell on larch changeset 52c1d5dc6aad without any CLI arguments at Assertion failure: !aheader->hasFreeThings(), and crashes js opt shell at IteratorNext [inlined]

This was found using a combination of jsfunfuzz and jandem's method fuzzer.

(not sure how correct this is):

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   81187:52c1d5dc6aad
tag:         tip
parent:      80945:17869dea1813
parent:      81186:6180c68bffbf
user:        Bill McCloskey
date:        Fri Dec 02 14:07:41 2011 -0800
summary:     Merge mozilla-central to larch
(Assignee)

Comment 1

6 years ago
This seems to have been fixed by
https://hg.mozilla.org/projects/larch/rev/eeaf42070e8a
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
(Reporter)

Updated

6 years ago
Crash Signature: [@ IteratorNext [inlined]]
You need to log in before you can comment on or make changes to this bug.