1235874 - Crash [@ strlen] or [@ strdup]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision c690c50b2b54 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --ion-eager):

evaluate("evalcx(\"x\")", {
    fileName: null
})

Backtrace:

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   libsystem_c.dylib             	0x00007fff8625b152 strlen + 18
1   libsystem_c.dylib             	0x00007fff862b5b79 strdup + 18
2   js-dbg-64-dm-darwin-c690c50b2b54	0x00000001005388f5 JS::DescribeScriptedCaller(JSContext*, mozilla::UniquePtr<char, JS::FreePolicy>*, unsigned int*, unsigned int*) + 277 (UniquePtr.h:290)
3   js-dbg-64-dm-darwin-c690c50b2b54	0x0000000100010cf7 EvalInContext(JSContext*, unsigned int, JS::Value*) + 1319 (Maybe.h:91)
4   js-dbg-64-dm-darwin-c690c50b2b54	0x00000001007527c2 js::Invoke(JSContext*, JS::CallArgs const&, js::MaybeConstruct) + 786 (jscntxtinlines.h:236)
5   js-dbg-64-dm-darwin-c690c50b2b54	0x0000000100752ffb js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) + 555 (Interpreter.cpp:512)
6   js-dbg-64-dm-darwin-c690c50b2b54	0x0000000100190a0b js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) + 2811 (BaselineIC.cpp:6184)
7   ???                           	0x0000000101df52db 0 + 4326380251
8   ???                           	0x0000000103e2aac0 0 + 4360153792

Seems to be a null-deref but setting this [fuzzblocker] s-s to be safe.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack of opt crash

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/5e0769303a5e
user:        Luke Wagner
date:        Mon Dec 28 17:39:37 2015 -0600
summary:     Bug 1229642 - change to AsmJSActivation to WasmActivation (r=bbouvier)

Luke, is bug 1229642 a likely regressor?

Comment 3

[Luke Wagner [:luke]]

Attachment: handle-null-filename

D'oh, null filename.  I don't think it's s-s since it's definitely near-null.

Comment 4

[Luke Wagner [:luke]]

Attachment: handle-null-filename

Probably better to clear filename if !i.filename() in the off chance the caller had previous contents.

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Opening up as per comment 3. Thanks for fixing this quickly!

Comment 6

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8130a1608ca0

Comment 7

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/8130a1608ca0