959163 - Crash [@ mozilla::DebugOnly<JS::Zone*>::DebugOnly] with Array.buildPar

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 12d3ba62a599 (threadsafe build, run with --fuzzing-safe --thread-count=2 --ion-compile-try-catch):


var actual = '';
var formatter = new Intl.NumberFormat();
var f = function() {
    return Array.buildPar(256, function(i) {
        var x = [];
        x[actual] = i;
    }, {mode:"compile"});
};
f();
f();

Comment 1

[Christian Holler (:decoder)]

Options got a bit messed up, thread count and --ion-compile-try-catch isn't needed for this.

Comment 2

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 3

[Shu-yu Guo [:shu]]

Attachment: Fix debug asserts in PropertyTree::lookupChild.

PropertyTree::lookupChild can return a null Shape *. Only do the debug zone
asserts on non-null Shape *s.

Comment 4

[Jason Orendorff [:jorendorff]]

Comment on attachment 8361410 [details] [diff] [review]
Fix debug asserts in PropertyTree::lookupChild.

Review of attachment 8361410 [details] [diff] [review]:
-----------------------------------------------------------------

Sorry for the delay here.

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/1f44e9a52d8e

Comment 6

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.