762324 - "Assertion failure: pc == bce->code(top + tableSize),"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: testcase

The attached testcase asserts js debug shell on m-c changeset f918d74f736c without any CLI arguments at Assertion failure: pc == bce->code(top + tableSize),

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Unfortunately I was not able to get a bisection in time.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Tested on 64-bit Windows 7.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   95044:699a613bf616
user:        Benjamin Peterson
date:        Sat May 26 09:33:53 2012 -0400
summary:     Bug 757676 - Implement JS default parameters. r=jorendorff

Comment 5

[:Benjamin Peterson]

Attachment: don't let the memory change under us

Interesting bug!

Comment 6

[:Benjamin Peterson]

The security sensitivity of this bug comes from its potential to write to memory not owned by the JS engine.

Comment 7

[:Benjamin Peterson]

Comment on attachment 636033 [details] [diff] [review]
don't let the memory change under us

[Approval Request Comment]
Bug caused by (feature/regressing bug #): Bug 757676
User impact if declined: JS can potentially write to random memory
Testing completed (on m-c, etc.): Features is well tested by js engine tests.
Risk to taking this patch (and alternatives if risky): None; only sane solution really.
String or UUID changes made by this patch: None

Comment 8

[Alex Keybl [:akeybl]]

Comment on attachment 636033 [details] [diff] [review]
don't let the memory change under us

[Triage Comment]
Low risk sg:crit fix for Aurora 15.

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

http://hg.mozilla.org/integration/mozilla-inbound/rev/73421f48fe54

Comment 10

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Removed checkin-needed for the moment; we should let it bake on inbound / central for at least a few days before landing on aurora.

Comment 11

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/73421f48fe54

Comment 12

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 13

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

http://hg.mozilla.org/releases/mozilla-aurora/rev/3f11aed80c16

Comment 14

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929