710322 - Invalid read of size 8 with testcase at js::SprintPut in Valgrind

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

"" + Function("\
  for each (let z in [\
    (4277), ['z'], (4277), (4277), ['z'], (4277), ['z'], \
    (4277), (4277), ['z'], ['z'], ['z'], ['z'], (4277), \
    (4277), (4277), ['z'], (4277), (4277), ['z'], ['z'], \
    (4277), (4277), (4277), ['z'], (4277), ['z']\
  ]) {}\
")

The attached testcase shows a Valgrind error in js opt shell on m-c changeset 63bff373cb94 without any CLI arguments with an invalid read of size 8.

The following command was used:

valgrind --smc-check=all-non-file --dsymutil=yes ./js testcase.js

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> "" + Function("\
>   for each (let z in [\
>     (4277), ['z'], (4277), (4277), ['z'], (4277), ['z'], \
>     (4277), (4277), ['z'], ['z'], ['z'], ['z'], (4277), \
>     (4277), (4277), ['z'], (4277), (4277), ['z'], ['z'], \
>     (4277), (4277), (4277), ['z'], (4277), ['z']\
>   ]) {}\
> ")
> 
> The attached testcase shows

(I meant *this* testcase shows...)

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This does not reproduce on 64-bit opt shell when run under Valgrind in Ubuntu Linux 11.10, on m-c changeset 8ffdb4c7404a.

Should retest on Valgrind Mac when bug 715750 is fixed.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

WFM on Mac OS X 10.7, m-c changeset 76e469f863ae w/ a relatively recent SVN Valgrind build.