Crash [@ mozilla::DebugOnly<JS::Zone*>::DebugOnly] with Array.buildPar

VERIFIED FIXED in mozilla29

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
4 years ago
4 years ago

People

(Reporter: decoder, Assigned: shu)

Tracking

(Blocks: 1 bug, {crash, testcase})

Trunk
mozilla29
x86_64
Linux
crash, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(2 attachments)

(Reporter)

Description

4 years ago
The following testcase crashes on mozilla-central revision 12d3ba62a599 (threadsafe build, run with --fuzzing-safe --thread-count=2 --ion-compile-try-catch):


var actual = '';
var formatter = new Intl.NumberFormat();
var f = function() {
    return Array.buildPar(256, function(i) {
        var x = [];
        x[actual] = i;
    }, {mode:"compile"});
};
f();
f();
(Reporter)

Comment 1

4 years ago
Options got a bit messed up, thread count and --ion-compile-try-catch isn't needed for this.
(Reporter)

Comment 2

4 years ago
Created attachment 8359216 [details]
[crash-signature] Machine-readable crash signature
(Assignee)

Comment 3

4 years ago
Created attachment 8361410 [details] [diff] [review]
Fix debug asserts in PropertyTree::lookupChild.

PropertyTree::lookupChild can return a null Shape *. Only do the debug zone
asserts on non-null Shape *s.
Attachment #8361410 - Flags: review?(jorendorff)
(Assignee)

Updated

4 years ago
Assignee: nobody → shu
Status: NEW → ASSIGNED
Comment on attachment 8361410 [details] [diff] [review]
Fix debug asserts in PropertyTree::lookupChild.

Review of attachment 8361410 [details] [diff] [review]:
-----------------------------------------------------------------

Sorry for the delay here.
Attachment #8361410 - Flags: review?(jorendorff) → review+
https://hg.mozilla.org/mozilla-central/rev/1f44e9a52d8e
Status: ASSIGNED → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla29

Updated

4 years ago
Keywords: verifyme
(Reporter)

Updated

4 years ago
Status: RESOLVED → VERIFIED
(Reporter)

Comment 6

4 years ago
JSBugMon: This bug has been automatically verified fixed.

Updated

4 years ago
Keywords: verifyme
You need to log in before you can comment on or make changes to this bug.