624518 - JM: Assertion failure: !isTypeKnown(), at ../methodjit/RematInfo.h:167

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

This test case:
---
function f() {
    var a = new Int32Array();

    for (var i = 0; i < 10; i++) {
        a[4] = "" + null;
    }
}

f();
---
Triggers this assert with -m:

Assertion failure: !isTypeKnown(), at ../methodjit/RematInfo.h:167

Comment 1

[Jan de Mooij [:jandem]]

Btw, this does not crash in a release build. But using the wrong type tag (?) may be exploitable somehow, so marking security sensitive to be safe.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Thanks for the precaution, Jan. Silly bug, I forgot to eliminate the type guard if the type is known. The only security implication is that with some acrobatics you could get the address of any GC thing as an integer. But there's no arbitrary reads or writes.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/tracemonkey/rev/64139fb1b3fe

Comment 4

[Chris Leary [:cdleary] (not checking bugmail)]

http://hg.mozilla.org/mozilla-central/rev/64139fb1b3fe