Last Comment Bug 707816 - [IncrementalGC] Crash [@ IteratorNext [inlined]] or "Assertion failure: !aheader->hasFreeThings(),"
: [IncrementalGC] Crash [@ IteratorNext [inlined]] or "Assertion failure: !ahea...
Status: RESOLVED FIXED
: assertion, crash, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Mac OS X
: -- critical (vote)
: ---
Assigned To: Bill McCloskey (:billm)
:
:
Mentors:
Depends on:
Blocks: jsfunfuzz 630996 IncrementalGC
  Show dependency treegraph
 
Reported: 2011-12-05 13:35 PST by Gary Kwong [:gkw] [:nth10sd]
Modified: 2012-01-04 16:55 PST (History)
4 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
stacks (7.82 KB, text/plain)
2011-12-05 13:35 PST, Gary Kwong [:gkw] [:nth10sd]
no flags Details

Description Gary Kwong [:gkw] [:nth10sd] 2011-12-05 13:35:37 PST
Created attachment 579147 [details]
stacks

RegExp.prototype.__proto__[2] = 2
Function("\
  for(z in[0]) {\
    for(e in ((ArrayBuffer)(725485439)))\
      print\
  }\
")()

asserts js debug shell on larch changeset 52c1d5dc6aad without any CLI arguments at Assertion failure: !aheader->hasFreeThings(), and crashes js opt shell at IteratorNext [inlined]

This was found using a combination of jsfunfuzz and jandem's method fuzzer.

(not sure how correct this is):

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   81187:52c1d5dc6aad
tag:         tip
parent:      80945:17869dea1813
parent:      81186:6180c68bffbf
user:        Bill McCloskey
date:        Fri Dec 02 14:07:41 2011 -0800
summary:     Merge mozilla-central to larch
Comment 1 Bill McCloskey (:billm) 2011-12-06 11:26:10 PST
This seems to have been fixed by
https://hg.mozilla.org/projects/larch/rev/eeaf42070e8a

Note You need to log in before you can comment on or make changes to this bug.