If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

Assertion failure: pred->isLoopBackedge(), at c:\Users\mozilla\debug-builds\mozilla-central\js\src\jit/IonAnalysis.cpp:1918

RESOLVED DUPLICATE of bug 1118894

Status

()

Core
JavaScript Engine: JIT
RESOLVED DUPLICATE of bug 1118894
3 years ago
a year ago

People

(Reporter: Tomcat, Unassigned)

Tracking

(Blocks: 1 bug, {assertion})

Firefox Tracking Flags

(Not tracked)

Details

(URL)

Attachments

(1 attachment)

(Reporter)

Description

3 years ago
Created attachment 8519876 [details]
windgb data win 7 trunk debug build

found via bughunter on 

http://wallpaperswide.com/tom_clancys_splinter_cell_conviction-wallpapers.html

Steps to reproduce:
-> Load http://wallpaperswide.com/tom_clancys_splinter_cell_conviction-wallpapers.html in a Windows 7 Trunk Debug Build as example
---> Asssertion failure

filing as sec bug just in case. Exploitable failed here:

!exploitable 1.6.0.0
Exploitability Classification: UNKNOWN
Recommended Bug Title: Possible Stack Corruption starting at xul!AssertReversePostorder+0x000000000000014e (Hash=0x5943b9bc.0x09a6d749)

The stack trace contains one or more locations for which no symbol or module could be found. This may be a sign of stack corruption.
Component: JavaScript Engine → JavaScript Engine: JIT
Jan, can you look at this?  It would be good to get somebody to investigate before the page changes.  Also, how bad of an assertion is this?
Flags: needinfo?(jdemooij)
(In reply to Andrew McCreight [:mccr8] from comment #1)
> Jan, can you look at this?  It would be good to get somebody to investigate
> before the page changes.  Also, how bad of an assertion is this?

I could reproduce it once with a m-c debug build from last week (Nov 10), but it no longer crashes with the same build, new profile etc. Tomcat had the same issue and suggested it may depend on a particular ad or something.

I'll keep trying. CC'ing more people, it'd be great if somebody could repro this reliably...
According to the attachment, it asserts under AssertExtendedGraphCoherency after the MakeLoopsContiguous phase. The previous AssertExtendedGraphCoherency call after DCE apparently didn't assert. Forwarding so sunfish based on that...
Flags: needinfo?(jdemooij) → needinfo?(sunfish)
I am also unable to repro.
Carsten, okay to close this one?
Flags: needinfo?(cbook)
Looks like the fuzzers just found this too, bug 1118894 :)
I'm going to optimistically dupe this to the newer bug with a testcase. Although "worksforme" or "incomplete" might be equally valid destinations for this bug.
Status: NEW → RESOLVED
Last Resolved: 3 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1118894

Updated

3 years ago
Flags: needinfo?(sunfish)
(Reporter)

Updated

3 years ago
Flags: needinfo?(cbook)

Updated

2 years ago
Group: core-security → core-security-release
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.