Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now) Reporter
	Description • 15 years ago

function g(code) {
  f = Function(code);
  if (code.indexOf() - 1)
  z = 0
  for (a in f()) z
}
g("\
  yield this.__defineGetter__(\"x\",function(){print(z)});\
  let z=''.replace('')\
")
gc()
x


crashes js debug shell at JSString::hasFlag on JM tip without -j or -m, and crashes js opt shell at js_DeflateString at a weird memory address on JM tip without -j or -m.

Tested on Mac 10.6.2 64-bit JM rev 71ed74081c2d, does not seem to occur in 32-bit TM rev c5e80acb1e7d.

	Luke Wagner [:luke]
	Comment 1 • 15 years ago

Wow, another most excellent find.  The bug is with the contiguous-stack patch and generators not getting marked after being closed.  Fixed in JM:
http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/66970a486644

	Christian Holler (:decoder)
	Comment 3 • 12 years ago

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/testBug550743.js.