427191 - Crash [@ js_ExpandErrorArguments]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I found this bug using jsfunfuzz.js, and Jesse Ruderman helped to reduce it as much as possible. It triggers a crash @ js_ExpandErrorArguments de-referencing a random memory address.


let (numDummies = 13100) {
  for (let i = 0; i < numDummies; ++i)
    this["z" + (i + 10000)] = 5;
}

let (p = []) {
  p.__iterator__ = this;
  try { for(let y in p); } catch(e) { eeee = e; }
  try { for(let y in p); } catch(e) { eeee = e; }
  try { for(let y in p); } catch(e) { eeee = e; }
  try { for(let y in p); } catch(e) { eeee = e; }
}

Comment 1

[Damon Sicore (:damons)]

We need to fix this, and there are other fuzzer bugs in line to be fixed in the next dot release.  Wouldn't hold back 1.9 for this.

wanted1.9.0.x+

Comment 2

[Brendan Eich [:brendan]]

Attachment: proposed fix

js_ValueToPrintable* is another dangerous API (sorry). Igor, can you get this landed if good, or fix it better and r? me? Thanks,

/be

Comment 3

[Igor Bukanov]

Comment on attachment 314447 [details] [diff] [review]
proposed fix

Even if js_ValueToPrintableSource would have less hazard-friendly signature, js_ReportIsNotFunction still would need an extra root to hold its result. So tvr is inevitable here.

Comment 4

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 314447 [details] [diff] [review]
proposed fix

a1.9=beltzner

Comment 5

[Brendan Eich [:brendan]]

Fixed:

js/src/jsfun.c 3.276

/be

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Verified, no longer crashes in latest trunk opt js shell.

Comment 7

[Bob Clary [:bc] (inactive)]

Attachment: js1_7/geniter/regress-427191.js

I can't reproduce the original crash with this testcase. Can someone who could, please check and see if this testcase also reproduces the original crash?

Comment 8

[Igor Bukanov]

Nominating for 1.8.1 blocking as the bug may exist there and requires at least an investigation.

Comment 9

[Al Billings [:abillings - ex-MoCo]]

Gary, can you help Bob out here?

Comment 10

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I don't believe I have any builds of js shells anymore prior to 4th April 2008.

Comment 11

[Al Billings [:abillings - ex-MoCo]]

It is hard for 1.8.1.15 triage to approve this if it cannot be reproduced in Branch.

Comment 12

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Oh, you mean for 1.8.1.15, ok I'll get to it soon...

Comment 13

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The first set of commands don't work for 1.8.1.15, but works fine for trunk js shell:

===

gary-kwongs-mac-mini:lithium gk$ ./js-intelmac
js> let (numDummies = 13100) {
  for (let i = 0; i < numDummies; ++i)
    this["z" + (i + 10000)] = 5;
}
5
js> 

gary-kwongs-mac-mini:lithium gk$ ./js-moz18branch-intelmac
js> let (numDummies = 13100) {
typein:1: SyntaxError: missing ; before statement:
typein:1: let (numDummies = 13100) {
typein:1: .........................^
js>   for (let i = 0; i < numDummies; ++i)
typein:2: SyntaxError: missing ; after for-loop initializer:
typein:2:   for (let i = 0; i < numDummies; ++i)
typein:2: ...........^
js>     this["z" + (i + 10000)] = 5;
typein:3: ReferenceError: i is not defined
js> }
typein:4: SyntaxError: syntax error:
typein:4: }
typein:4: ^
js> 

gary-kwongs-mac-mini:lithium gk$

===

Igor, is there any tweak I should make for 1.8.1.15 in order for the error not to show up?

Comment 14

[Jesse Ruderman]

To test this on branch, you need to run

./js -v 170

or type "version(170);" into the prompt before pasting the script.  This is because branch defaults to treating |let| as an identifier rather than a keyword.

Comment 15

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The commands work as expected and do not crash on the latest branch js shell. (Thanks Jesse for the hint)

Comment 16

[Samuel Sidler (old account; do not CC)]

Can we open this bug up then? Fixed on the 1.8 branch somehow?

Comment 17

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #16)
> Can we open this bug up then? Fixed on the 1.8 branch somehow?

I just re-confirmed that the bug has somehow been fixed on the 1.8 branch. With "-v 170" on the commandline, the 1.8.1.x shell doesn't crash with the testcase anymore, and works as expected.

Comment 18

[Bob Clary [:bc] (inactive)]

when this bug is opened, the test should be checked in.