1046597 - Assertion failure: tag <= CalleeToken_Script, at jit/IonFrames.h:32 or Assertion failure: false (MOZ_ASSERT_UNREACHABLE: invalid callee token tag), at jit/IonFrames.h:72

Status: VERIFIED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 005424a764da (run with --no-threads --fuzzing-safe):


a = {}
b = __proto__
for (i = 0; i < 9000; i++) {
    __proto__ &=  a
    a.__proto__ = b
}

Comment 1

[Christian Holler (:decoder)]

Marked s-s because the assertions sound possibly security-related.

Comment 2

[Nicolas B. Pierron [:nbp]]

Attachment: bug analysis

2 NameIC::update calls, the failure happens in the second one.
Likely cause of failure is a bad stub which does not correctly balance the stack.

The descriptor is interpreted as a CalleeToken, thus the produced IC stub does one extra push which is not balanced.

The issue is in the fix made for Bug 1033873.

Comment 3

[Nicolas B. Pierron [:nbp]]

Attachment: Balance stack in failures cases.

Comment 4

[Nicolas B. Pierron [:nbp]]

Attachment: Balance stack in failures cases.

(Compiling version)
Fix this test case and Bug 1046675.

Comment 6

[Eric Faust [:efaust]]

Comment on attachment 8466279 [details] [diff] [review]
Balance stack in failures cases.

Review of attachment 8466279 [details] [diff] [review]:
-----------------------------------------------------------------

Yeah, my bad. Thanks for fixing this. r=me

Comment 7

[Nicolas B. Pierron [:nbp]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e77250bf9c07

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/e77250bf9c07

Comment 9

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

The fix for this was included in the backport of bug 1033873 to beta in order to fix bug 1067153.
https://hg.mozilla.org/releases/mozilla-beta/rev/2dbe6d8a5c30