202150 2019-09-24 10:39:41 -0700 [JSC] Null dereference in propagateTransitions 2019-09-26 11:09:08 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build Unspecified Unspecified RESOLVED DUPLICATE 202122 https://bugs.webkit.org/show_bug.cgi?id=200983 InRadar P2 Normal --- 1 antoniogroza webkit-unassigned fpizlo mark.lam prti tzagallo webkit-bug-importer ysuzuki oldest_to_newest 1573695 0 antoniogroza 2019-09-24 10:39:41 -0700 Hello, While fuzzing JSC i have found a test case that is able to reproduce the following issue: https://bugs.webkit.org/show_bug.cgi?id=200983 . function hax() { for (const v3 in "AAAAAAAAAAA") { const v4 = createGlobalObject(); with (v4) { v4.b = parseInt; v4.length = v3; const v6 = new Uint16Array(); } } } hax(); Execute it on an ASAN build of JSC with the following options to repro: ./jsc --useConcurrentJIT=false --useConcurrentGC=false --thresholdForJITSoon=10 --thresholdForJITAfterWarmUp=10 --thresholdForOptimizeAfterWarmUp=100 --thresholdForOptimizeAfterLongWarmUp=100 --thresholdForOptimizeAfterLongWarmUp=100 --thresholdForFTLOptimizeAfterWarmUp=1000 --thresholdForFTLOptimizeSoon=1000 --gcAtEnd=true poc.js 1574243 1 webkit-bug-importer 2019-09-25 15:26:54 -0700 <rdar://problem/55721330> 1574540 2 tzagallo 2019-09-26 11:09:08 -0700 *** This bug has been marked as a duplicate of bug 202122 ***