Closed Bug 1142993 Opened 10 years ago Closed 10 years ago

Assertion failure: !has(tmp), at /mozilla/builds/nightly/mozilla/js/src/jit/RegisterSets.h:392

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
All
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla39
Tracking Flags:
Tracking Status
firefox38 --- unaffected
firefox39 + fixed
firefox40 --- fixed
firefox-esr31 --- unaffected
firefox-esr38 --- unaffected
b2g-v1.4 --- unaffected
b2g-v2.0 --- unaffected
b2g-v2.0M --- unaffected
b2g-v2.1 --- unaffected
b2g-v2.1S --- unaffected
b2g-v2.2 --- unaffected
b2g-master --- fixed

People

(Reporter: cbook, Assigned: nbp)

References

(
URL
)

Details

(Keywords: assertion, sec-high)

Attachments

(2 files)

mac stack
150.65 KB, text/plain
Details
windows stack
110.69 KB, text/plain
Details
Found via Bughunter and reproduced on a Mac OS 10.9 Trunk Build based on mozilla-central tip Note: on Windows Bughunter reports this as medium exploitable Steps to reproduce: -> Load https://vimeo.com/11892211 --> Assertion failure: !has(tmp), at /mozilla/builds/nightly/mozilla/js/src/jit/RegisterSets.h:392
Attached file mac stack —
Attached file windows stack —
This seems to be a regression from bug 1140737, but I don't really understand why we're asserting. Maybe a register aliasing issue. The code looks fine to me though... bz, do you want to take a look? Else I can debug it.
status-firefox39: --- → affected
tracking-firefox39: --- → ?
Flags: needinfo?(jdemooij)
Depends on: 1143011
Can this issue be reproduced with Bug 1143011.
Blocks: 1143920
Keywords: sec-high
Based on comment 3 I will mark 38 as unaffected. It sounds like a regression in 39.
status-firefox38: --- → unaffected
Do we still have new reports since Bug 1143011 landed on mozilla-central?
Flags: needinfo?(cbook)
(In reply to Nicolas B. Pierron [:nbp] from comment #6) > Do we still have new reports since Bug 1143011 landed on mozilla-central? yeah does not crash anymore on my testcase \o/
Flags: needinfo?(cbook)
(In reply to Carsten Book [:Tomcat] from comment #7) > (In reply to Nicolas B. Pierron [:nbp] from comment #6) > > Do we still have new reports since Bug 1143011 landed on mozilla-central? > > yeah does not crash anymore on my testcase \o/ Good :) The patch got backout from aurora (Bug 1149377), so it might be broken on aurora. I waiting for tens of PGO build results to find where PGO is failing.
Clearing needinfo, bug 1143011 should have fixed this.
Flags: needinfo?(jdemooij)
yes marking fixed for firefox 40 by bug 1143011 - for Fx39 this need be landed on aurora where its currently backed out
Status: NEW → RESOLVED
Closed: 10 years ago
status-firefox40: --- → fixed
Resolution: --- → FIXED
Assignee: nobody → nicolas.b.pierron
status-b2g-v1.4: --- → unaffected
status-b2g-v2.0: --- → unaffected
status-b2g-v2.0M: --- → unaffected
status-b2g-v2.1: --- → unaffected
status-b2g-v2.1S: --- → unaffected
status-b2g-v2.2: --- → unaffected
status-b2g-master: --- → fixed
status-firefox39: affected → fixed
status-firefox-esr31: --- → unaffected
status-firefox-esr38: --- → unaffected
Flags: in-testsuite?
Target Milestone: --- → mozilla39
Group: core-security
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: