1234979 - AddressSanitizer: SEGV /builds/slave/m-cen-l64-asan-000000000000000/build/src/js/src/jsobj.h:122

Status: RESOLVED DUPLICATE of bug 1233100

(Core :: JavaScript Engine, defect)

Description

[Spandan Veggalam]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:43.0) Gecko/20100101 Firefox/43.0
Build ID: 20151210084639

Steps to reproduce:

JS shell artifact linux64-asan build

class base {}
class derived extends base {
  constructor() {
    try {
      return;
    } catch (e) {
      try {
        return;
      } catch (e) {}
    }
  }
}
assertThrowsInstanceOf(() => new derived, ReferenceError);


Actual results:

ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000013ef521 sp 0x7ffd12b0af00 bp 0x7ffd12b0af00 T0)     
#0 0x13ef520 in getClass /builds/slave/m-cen-l64-asan-000000000000000/build/src/js/src/jsobj.h:122     
#1 0x13ef520 in is<js::BlockObject> /builds/slave/m-cen-l64-asan-000000000000000/build/src/js/src/jsobj.h:543     
#2 0x13ef520 in operator-> /builds/slave/m-cen-l64-asan-000000000000000/build/src/js/src/vm/ScopeObject.h:1310     
#3 0x13ef520 in type /builds/slave/m-cen-l64-asan-000000000000000/build/src/js/src/vm/ScopeObject-inl.h:152     
#4 0x13ef520 in js::ScopeIter::type() const /builds/slave/m-cen-l64-asan-000000000000000/build/src/js/src/vm/ScopeObject.cpp:1450     
#5 0x12cb621 in PopScope(JSContext*, js::ScopeIter&) /builds/slave/m-cen-l64-asan-000000000000000/build/src/js/src/vm/Interpreter.cpp:880     
#6 0x12cb48c in js::UnwindScope(JSContext*, js::ScopeIter&, unsigned char*) /builds/slave/m-cen-l64-asan-000000000000000/build/src/js/src/vm/Interpreter.cpp:908     
#7 0x12fc9cf in SettleOnTryNote(JSContext*, JSTryNote*, js::ScopeIter&, js::InterpreterRegs&) /builds/slave/m-cen-l64-asan-000000000000000/build/src/js/src/vm/Interpreter.cpp:966     
#8 0x12c6008 in ProcessTryNotes /builds/slave/m-cen-l64-asan-000000000000000/build/src/js/src/vm/Interpreter.cpp:1025     
#9 0x12c6008 in HandleError /builds/slave/m-cen-l64-asan-000000000000000/build/src/js/src/vm/Interpreter.cpp:1117     
#10 0x12c6008 in Interpret(JSContext*, js::RunState&) /builds/slave/m-cen-l64-asan-000000000000000/build/src/js/src/vm/Interpreter.cpp:3807     
#11 0x129583d in js::RunScript(JSContext*, js::RunState&) /builds/slave/m-cen-l64-asan-000000000000000/build/src/js/src/vm/Interpreter.cpp:341     
#12 0x127d7b6 in js::Invoke(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/slave/m-cen-l64-asan-000000000000000/build/src/js/src/vm/Interpreter.cpp:412     
#13 0x12b55cd in Interpret(JSContext*, js::RunState&) /builds/slave/m-cen-l64-asan-000000000000000/build/src/js/src/vm/Interpreter.cpp:2686     
#14 0x129583d in js::RunScript(JSContext*, js::RunState&) /builds/slave/m-cen-l64-asan-000000000000000/build/src/js/src/vm/Interpreter.cpp:341     
#15 0x12c8458 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, JS::Value const&, js::ExecuteType, js::AbstractFramePtr, JS::Value*) /builds/slave/m-cen-l64-asan-000000000000000/build/src/js/src/vm/Interpreter.cpp:603     
#16 0x12c8c08 in js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) /builds/slave/m-cen-l64-asan-000000000000000/build/src/js/src/vm/Interpreter.cpp:639     #17 0xef083e in ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::Value*) /builds/slave/m-cen-l64-asan-000000000000000/build/src/js/src/jsapi.cpp:4390     
#18 0xef0a1d in JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>) /builds/slave/m-cen-l64-asan-000000000000000/build/src/js/src/jsapi.cpp:4423     
#19 0x4b71d8 in RunFile /builds/slave/m-cen-l64-asan-000000000000000/build/src/js/src/shell/js.cpp:515     
#20 0x4b71d8 in Process(JSContext*, char const*, bool, FileKind) /builds/slave/m-cen-l64-asan-000000000000000/build/src/js/src/shell/js.cpp:728     
#21 0x4ab86f in ProcessArgs /builds/slave/m-cen-l64-asan-000000000000000/build/src/js/src/shell/js.cpp:6141     
#22 0x4ab86f in Shell /builds/slave/m-cen-l64-asan-000000000000000/build/src/js/src/shell/js.cpp:6482     
#23 0x4ab86f in main /builds/slave/m-cen-l64-asan-000000000000000/build/src/js/src/shell/js.cpp:6843     
#24 0x7fbf2876ea3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f)     
#25 0x49b47c in _start (/home/rubbernecker/jsengines/jsshell_asan/js+0x49b47c)  AddressSanitizer can not provide additional info.

Comment 1

[Daniel Veditz [:dveditz]]

Does not look exploitable. Eric?

Comment 2

[Eric Faust [:efaust]]

No, this should always be a crash at null, in practice. It's also fixed, as of bug 1233100.

Comment 4

[Al Billings [:abillings - ex-MoCo]]

Minusing for bounty as it is a null point issue and a duplicate of a known report from a week earlier.