707816 - [IncrementalGC] Crash [@ IteratorNext [inlined]] or "Assertion failure: !aheader->hasFreeThings(),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stacks

RegExp.prototype.__proto__[2] = 2
Function("\
  for(z in[0]) {\
    for(e in ((ArrayBuffer)(725485439)))\
      print\
  }\
")()

asserts js debug shell on larch changeset 52c1d5dc6aad without any CLI arguments at Assertion failure: !aheader->hasFreeThings(), and crashes js opt shell at IteratorNext [inlined]

This was found using a combination of jsfunfuzz and jandem's method fuzzer.

(not sure how correct this is):

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   81187:52c1d5dc6aad
tag:         tip
parent:      80945:17869dea1813
parent:      81186:6180c68bffbf
user:        Bill McCloskey
date:        Fri Dec 02 14:07:41 2011 -0800
summary:     Merge mozilla-central to larch

Comment 1

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

This seems to have been fixed by
https://hg.mozilla.org/projects/larch/rev/eeaf42070e8a