Crash [@ js_Invoke] [@ QuoteString] with export/import and setter

VERIFIED FIXED in mozilla1.8.1

Status

()

Core
JavaScript Engine
P1
critical
VERIFIED FIXED
11 years ago
6 years ago

People

(Reporter: Jesse Ruderman, Assigned: brendan)

Tracking

(Blocks: 1 bug, 4 keywords)

Trunk
mozilla1.8.1
crash, testcase, verified1.8.0.8, verified1.8.1
Points:
---
Bug Flags:
blocking1.8.0.8 +
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [sg:critical], crash signature)

Attachments

(2 attachments)

(Reporter)

Description

11 years ago
js> this.x setter= function(){}; export *; t = this; new Function("import t.*; import t.*;")();
Segmentation fault

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_INVALID_ADDRESS (0x0001) at 0x7c0802a6

Thread 0 Crashed:
0   js 	0x0002f57c QuoteString + 176 (jsopcode.c:468)
1   js 	0x0002fbac js_QuoteString + 132 (jsopcode.c:555)
2   js 	0x0007d7e0 js_ValueToSource + 76 (jsstr.c:2688)
3   js 	0x0003f59c js_DecompileValueGenerator + 3868 (jsopcode.c:4748)
4   js 	0x00056dc8 js_ReportIsNotFunction + 220 (jsfun.c:2241)
5   js 	0x00093b1c js_Invoke + 4712 (jsinterp.c:1436)
6   js 	0x00093cfc js_InternalInvoke + 444 (jsinterp.c:1467)
7   js 	0x00094034 js_InternalGetOrSet + 552 (jsinterp.c:1527)
8   js 	0x0004b448 js_SetProperty + 2804 (jsobj.c:3631)
9   js 	0x00094b0c ImportProperty + 1524 (jsinterp.c:1730)
10  js 	0x000aa6f8 js_Interpret + 85440 (jsinterp.c:4718)
11  js 	0x00094400 js_Execute + 936 (jsinterp.c:1618)
12  js 	0x00021578 JS_ExecuteScript + 64 (jsapi.c:4256)
13  js 	0x00003084 Process + 904 (js.c:265)
14  js 	0x00003c4c ProcessArgs + 2304 (js.c:487)
15  js 	0x0000a03c main + 640 (js.c:3088)
16  js 	0x000023e8 _start + 340 (crt.c:272)
17  js 	0x00002290 start + 60
(Reporter)

Updated

11 years ago
Whiteboard: [sg:critical]
(Assignee)

Comment 1

11 years ago
Created attachment 240741 [details] [diff] [review]
minimal fix

The old Netscape 4-era import stuff is ill-defined for getters and setters, but in order to avoid flagging a native JSPropertOp as if it were a function object, we must clear the JSPROP_(GETTER|SETTER) attributes at a minimum.

/be
Assignee: general → brendan
Status: NEW → ASSIGNED
Attachment #240741 - Flags: review?(mrbkap)
Attachment #240741 - Flags: approval1.8.1?
(Assignee)

Updated

11 years ago
OS: Mac OS X 10.4 → All
Priority: -- → P1
Hardware: Macintosh → All
Target Milestone: --- → mozilla1.8.1
(Assignee)

Comment 2

11 years ago
Comment on attachment 240741 [details] [diff] [review]
minimal fix

We tried to remove JS_HAS_EXPORT_IMPORT but someone was using it.  For Mozilla 1.9, we could try again.  For Mozilla 2, we will remove all this junk.

In the mean time, this patch is a safe fix for any near-term release.  I'm not sure how easy it is to stumble on the testcase with the fuzzer, but I'd rather not risk anyone doing that.

/be
Attachment #240741 - Flags: review?(igor.bukanov)
(Assignee)

Comment 3

11 years ago
See comment 1 and comment 2.

/be
Flags: blocking1.8.1?
Flags: blocking1.8.1.1?

Updated

11 years ago
Attachment #240741 - Flags: review?(igor.bukanov) → review+
(Assignee)

Comment 4

11 years ago
Fixed on trunk:

Checking in jsinterp.c;
/cvsroot/mozilla/js/src/jsinterp.c,v  <--  jsinterp.c
new revision: 3.294; previous revision: 3.293
done

/be
Status: ASSIGNED → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → FIXED

Updated

11 years ago
Attachment #240741 - Flags: review?(mrbkap) → review+

Comment 5

11 years ago
Comment on attachment 240741 [details] [diff] [review]
minimal fix

Approved for RC2.
Attachment #240741 - Flags: approval1.8.1? → approval1.8.1+
(Assignee)

Comment 6

11 years ago
Fixed on the 1.8 branch:

Checking in jsinterp.c;
/cvsroot/mozilla/js/src/jsinterp.c,v  <--  jsinterp.c
new revision: 3.181.2.65; previous revision: 3.181.2.64
done

/be
Keywords: fixed1.8.1
This looks like we need it for 1.8.0.8 as well? Please request approval on the patch if so.
Flags: blocking1.8.0.8?
(Assignee)

Updated

11 years ago
Attachment #240741 - Flags: approval1.8.0.8?

Comment 8

11 years ago
Created attachment 240894 [details]
js1_5/Regress/regress-354924.js

I could not reproduce this crash. Jesse can you verify this bug?

Updated

11 years ago
Flags: in-testsuite+
Flags: blocking1.8.0.8? → blocking1.8.0.8+
Comment on attachment 240741 [details] [diff] [review]
minimal fix

approved for 1.8.0 branch, a=dveditz for drivers
Attachment #240741 - Flags: approval1.8.0.8? → approval1.8.0.8+
(Assignee)

Comment 10

11 years ago
Checking in jsinterp.c;
/cvsroot/mozilla/js/src/jsinterp.c,v  <--  jsinterp.c
new revision: 3.181.2.17.2.22; previous revision: 3.181.2.17.2.21
done

/be
Keywords: fixed1.8.0.8
(Reporter)

Comment 11

11 years ago
Verified fixed (by testing in opt and debug jsshell on Mac).
Status: RESOLVED → VERIFIED

Comment 12

11 years ago
verified fixed 1.8 1.9 20061002 windows/linux 1.8 macppc
Keywords: fixed1.8.1 → verified1.8.1

Comment 13

11 years ago
verified fixed 1.8.0.8 20061003 windows/mac*/linux
Keywords: fixed1.8.0.8 → verified1.8.0.8
Flags: blocking1.8.1?
Flags: blocking1.8.1.1?
Group: security

Comment 14

11 years ago
RCS file: /cvsroot/mozilla/js/tests/js1_5/Regress/regress-354924.js,v
done
Checking in regress-354924.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-354924.js,v  <--  regress-354924.js
initial revision: 1.1
done
(Reporter)

Updated

10 years ago
No longer blocks: 349611
(Reporter)

Updated

10 years ago
Blocks: 349611
Crash Signature: [@ js_Invoke] [@ QuoteString]
You need to log in before you can comment on or make changes to this bug.