435497 - [1.8 branch] Crash [@ js_Interpret] or [@ js_HashString]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I found this bug and Jesse Ruderman helped to reduce the testcases.

(function() { x, x setter = 0, y; const x; })()

crashes at js_HashString calling memory address 0x000000003b517c41, and this changes when 0 is replaced by 1 or 2 etc.

(function() { x setter = 0, y; const x; })()

or

(function() { x getter= function(){} ; var x5, x = 0x99; })()

crash at js_Interpret calling memory address 0x0000000080000000.

They also assert at

Assertion failure: op2 == JSOP_INITELEM, at jsinterp.c:5132

May possibly be related to bug 434906?

I nominate them for blocking1.8.1.15 because they crash at scary non-null memory addresses, thus I think they may be exploitable. These testcases seem to get hit quite easily as evident by the sample testcases in both this bug and its possible cousin bug 434906.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: full backtrace for the assertion of the 1st testcase

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: full backtrace for the assertion of the 2nd testcase

Separate sidenote: trunk js shell seem to work as expected with the testcases in comment #0.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: comparison between the 2 stacktraces

Here's a graphical diff of the 2 stacktraces; I'm not sure if it's useful, but nonetheless I hope it helps.

Comment 4

[Samuel Sidler (old account; do not CC)]

Too late for 1.8.1.15 with no patch, but we want this. Nominating for 1.8.1.16.

Brian, can you look at this?

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Isn't this a dupe of bug 356378?

Comment 6

[Samuel Sidler (old account; do not CC)]

Gary, is this fixed for you in recent branch nightlies (or, really, Firefox 2.0.0.15)?

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Sam, yes this is fixed, please resolve as appropriate. (WFM?)

Sample output after running the testcases in js shell, which now no longer crashes:

$ ./js-moz181-intelmac
js> (function() { x, x setter = 0, y; const x; })()
typein:1: SyntaxError: invalid setter usage
js> (function() { x setter = 0, y; const x; })()
typein:2: SyntaxError: invalid setter usage
js> (function() { x getter= function(){} ; var x5, x = 0x99; })()
typein:3: SyntaxError: invalid getter usage
js>

Comment 8

[Samuel Sidler (old account; do not CC)]

Fixed by bug 356378. (Opening up as well since that bug is open.)

Comment 9

[Samuel Sidler (old account; do not CC)]

Removing blocking flag too.

Comment 10

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_5/extensions/regress-435497-01.js,v  <--  regress-435497-01.js
initial revision: 1.1

/cvsroot/mozilla/js/tests/js1_5/extensions/regress-435497-02.js,v  <--  regress-435497-02.js
initial revision: 1.1

/cvsroot/mozilla/js/tests/js1_5/extensions/regress-435497-03.js,v  <--  regress-435497-03.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/b04c04268a94

Comment 11

[Bob Clary [:bc] (inactive)]

verified fixed on 1.9.1, 1.9.0, 1.8.1. verifying for 1.8.1.16 since bug 356378 was verified on 1.8.1.15.