1425582 - Crash in memcpy | js::XDRState<T>::codeBytes

Status: RESOLVED DUPLICATE of bug 1407651

(Core :: JavaScript Engine, defect, P2)

Description

[Trevor Skywalker]

This bug was filed from the Socorro interface and is
report bp-fc5c04cb-3c2d-4a5a-b49f-e5d290171215.
=============================================================

Top 7 frames of crashing thread:

0 vcruntime140.dll memcpy f:\dd\vctools\crt\vcruntime\src\string\i386\memcpy.asm:194
1 xul.dll js::XDRState<1>::codeBytes js/src/vm/Xdr.h:331
2 xul.dll js::ScriptSource::performXDR<1> js/src/jsscript.cpp:2220
3 xul.dll js::XDRScript<1> js/src/jsscript.cpp:632
4 mozglue.dll arena_t::Malloc memory/build/mozjemalloc.cpp:2994
5 xul.dll mozilla::Vector<char, 0, js::SystemAllocPolicy>::growStorageBy mfbt/Vector.h:991
6 xul.dll js::XDRState<1>::codeScript js/src/vm/Xdr.cpp:183

=============================================================

Comment 1

[Jason Orendorff [:jorendorff]]

Well... this particular stack is a bit of a mess. There are a lot of reports for this signature, though, and some of the stacks are cleaner.

1 is XDR_DECODE.

Ted, is this useful?

Comment 2

[Ted Campbell [:tcampbell]]

Gonna close this as dupe. Root cause of corruption unknown, but this manifestation is already understood. The crashes are bad and we could probably add the checks earlier so it fails operation instead of crashing. In this case, the source of a memcpy is too small, but if we didn't crash later checks would have thrown away the data anyways.