1672674 - segment fault

Status: RESOLVED INVALID

(Core :: JavaScript Engine, task)

Description

[1422930734]

Attachment: 2

1 . version:
JavaScript-C72.0a1
2. git commit:
27ded6834ef8b61fa52838acd59fe617bf44c61c

3 . command:
./js poc
4. description:
0x555555e618ab <js::AutoEnterOOMUnsafeRegion::crash(char+0> call 0x555555e6195f <MOZ_ReportCrash(char const*, char const*, int)>
0x555555e618b0 <js::AutoEnterOOMUnsafeRegion::crash(char+0> lea rax, [rip+0x2fee399] # 0x555558e4fc50 <gMozCrashReason>
0x555555e618b7 <js::AutoEnterOOMUnsafeRegion::crash(char+0> mov QWORD PTR [rax], rbx
→ 0x555555e618ba <js::AutoEnterOOMUnsafeRegion::crash(char+0> mov DWORD PTR ds:0x0, 0x5f5
0x555555e618c5 <js::AutoEnterOOMUnsafeRegion::crash(char+0> call 0x55555593f980 <abort()>
0x555555e618ca <js::ReportOutOfMemoryResult(JSContext*)+0> push rbp
0x555555e618cb <js::ReportOutOfMemoryResult(JSContext*)+1> mov rbp, rsp
0x555555e618ce <js::ReportOutOfMemoryResult(JSContext*)+4> push rbx
0x555555e618cf <js::ReportOutOfMemoryResult(JSContext*)+5> push rax
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── threads ────
[#0] Id 1, Name: "js", stopped 0x555555e618ba in MOZ_Crash (), reason: SIGSEGV
[#1] Id 3, Name: "JS Helper", stopped 0x7ffff7bc7360 in pthread_cond_wait@@GLIBC_2.3.2 (), reason: SIGSEGV
[#2] Id 4, Name: "JS Helper", stopped 0x7ffff7bc7360 in pthread_cond_wait@@GLIBC_2.3.2 (), reason: SIGSEGV
[#3] Id 5, Name: "JS Helper", stopped 0x7ffff7bc7360 in pthread_cond_wait@@GLIBC_2.3.2 (), reason: SIGSEGV
[#4] Id 6, Name: "JS Helper", stopped 0x7ffff7bc7360 in pthread_cond_wait@@GLIBC_2.3.2 (), reason: SIGSEGV
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── trace ────
[#0] 0x555555e618ba → MOZ_Crash(aFilename=<optimized out>, aLine=<optimized out>, aReason=<optimized out>)
[#1] 0x555555e618ba → js::AutoEnterOOMUnsafeRegion::crash(this=<optimized out>, reason=<optimized out>)
[#2] 0x555555fc18f0 → JSScript::argumentsOptimizationFailed(cx=<optimized out>, script=<optimized out>)
[#3] 0x555556aeaf2f → js::GuardFunApplyArgumentsOptimization(cx=<optimized out>, frame=<optimized out>, args=<optimized out>)
[#4] 0x555556aeaf2f → js::jit::DoCallFallback(cx=<optimized out>, frame=0x7ffffffe8fb8, stub=<optimized out>, argc=0x2, vp=<optimized out>, res=<optimized out>)
[#5] 0x27604df40798 → add rsp, 0x8
[#6] 0x7ffff5d74af0 → (bad)
[#7] 0x7ffffffe8f10 → add BYTE PTR [rax], al

Comment 1

[Jason Orendorff [:jorendorff]]

This just throws "out of memory" for me.

This test case uses gcparam, a testing function that is not exposed to web scripts.

When the engine crashes with MOZ_Crash(), it does so safely, so there is no security risk here.