1458035 - firefox 52 segfault in js

Status: UNCONFIRMED

(Core :: JavaScript: Internationalization API, defect, P3)

Description

[vitalik.perevertun]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Build ID: 20180317190926

Steps to reproduce:

<path>/firefox-52.7.2esr/js/src/builtin/Intl.cpp:964
        collation = 0x0
        jscollation = {<js::RootedBase<JSString*>> = {<No data fields>}, stack = 0x7ffffffe9230, prev = 0xfffa000000000009, ptr = 0x7fffc108c850}
        element =

see patch.

possible null access in equal function.

https://hg.mozilla.org/releases/mozilla-esr52/file/tip/js/src/builtin/Intl.cpp#l670
https://hg.mozilla.org/releases/mozilla-esr52/file/tip/js/src/builtin/Intl.cpp#l964

Comment 1

[vitalik.perevertun]

Attachment: ff52_segfault.patch

Comment 2

[Daniel Bodea [:danibodea]]

Based on the bugs fixed/revisions of the files containing the issue, the bug probably belongs to the Core - JavaScript: internationalization API. I have set the component accordingly. Please set it correctly if it does not belong there.

Comment 3

[André Bargull [:anba]]

Unless this is a self-built Firefox with system-ICU using ICU58 [1], this could be another issue where ICU doesn't report OOM errors [2,3]. In that case we probably need to handle null-pointer returns from uenum_next() explicitly in js::intl_availableCollations() and js::intl_availableCalendars(). Or we remove the uenum_count() call and instead stop enumeration when the first null-pointer was seen (which then means we either have traversed the complete enumerator or ICU OOM-ed without setting an error status). (We already do the latter in all other cases when we enumerate over ICU enumerators, because uenum_count() is actually documented as potentially being expensive [4], so we avoid it elsewhere...)

[1] http://bugs.icu-project.org/trac/ticket/12827
[2] http://bugs.icu-project.org/trac/ticket/13712
[3] http://bugs.icu-project.org/trac/ticket/13739
[4] http://icu-project.org/apiref/icu4c/uenum_8h.html#a8be6db20419d79ecdd71e717a9521773

Comment 4

[vitalik.perevertun]

I have another bug (possible null access) in js.

52 Branch is already closed for bug fix?

Or i can write here about this bug?