465705 - Valgrind - invalid read of size 1 in js_PCToLineNumber - js1_5/extensions/regress-454040.js

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Bob Clary [:bc] (inactive)]

==4311== Invalid read of size 1
==4311==    at 0x80BA70B: js_PCToLineNumber (in /usr3/work/mozilla/builds/1.9.1/mozilla/js/src/Linux_All_OPT.OBJ/js)
==4311==    by 0x80BA73C: js_FramePCToLineNumber (in /usr3/work/mozilla/builds/1.9.1/mozilla/js/src/Linux_All_OPT.OBJ/js)
==4311==    by 0x8090534: js_ComputeFilename (in /usr3/work/mozilla/builds/1.9.1/mozilla/js/src/Linux_All_OPT.OBJ/js)
==4311==    by 0x8071DC3: Function(JSContext*, JSObject*, unsigned, long*, long*) (in /usr3/work/mozilla/builds/1.9.1/mozilla/js/src/Linux_All_OPT.OBJ/js)
==4311==    by 0x8088E58: js_Invoke (in /usr3/work/mozilla/builds/1.9.1/mozilla/js/src/Linux_All_OPT.OBJ/js)
==4311==    by 0x80891E7: js_InternalInvoke (in /usr3/work/mozilla/builds/1.9.1/mozilla/js/src/Linux_All_OPT.OBJ/js)
==4311==    by 0x8060018: js_watch_set (in /usr3/work/mozilla/builds/1.9.1/mozilla/js/src/Linux_All_OPT.OBJ/js)
==4311==    by 0x806016A: js_watch_set_wrapper (in /usr3/work/mozilla/builds/1.9.1/mozilla/js/src/Linux_All_OPT.OBJ/js)
==4311==    by 0x8088E58: js_Invoke (in /usr3/work/mozilla/builds/1.9.1/mozilla/js/src/Linux_All_OPT.OBJ/js)
==4311==    by 0x80891E7: js_InternalInvoke (in /usr3/work/mozilla/builds/1.9.1/mozilla/js/src/Linux_All_OPT.OBJ/js)
==4311==    by 0x80892F8: js_InternalGetOrSet (in /usr3/work/mozilla/builds/1.9.1/mozilla/js/src/Linux_All_OPT.OBJ/js)
==4311==    by 0x808F2F6: js_NativeSet (in /usr3/work/mozilla/builds/1.9.1/mozilla/js/src/Linux_All_OPT.OBJ/js)
==4311==  Address 0x40438F5 is 0 bytes after a block of size 53 alloc'd
==4311==    at 0x40053C0: malloc (vg_replace_malloc.c:149)
==4311==    by 0x8050C97: JS_malloc (in /usr3/work/mozilla/builds/1.9.1/mozilla/js/src/Linux_All_OPT.OBJ/js)
==4311==    by 0x80BAC6B: js_NewScript (in /usr3/work/mozilla/builds/1.9.1/mozilla/js/src/Linux_All_OPT.OBJ/js)
==4311==    by 0x8071B58: js_InitFunctionClass (in /usr3/work/mozilla/builds/1.9.1/mozilla/js/src/Linux_All_OPT.OBJ/js)
==4311==    by 0x80522D1: js_InitFunctionAndObjectClasses (in /usr3/work/mozilla/builds/1.9.1/mozilla/js/src/Linux_All_OPT.OBJ/js)
==4311==    by 0x808F767: js_GetClassObject (in /usr3/work/mozilla/builds/1.9.1/mozilla/js/src/Linux_All_OPT.OBJ/js)
==4311==    by 0x80935B5: js_FindClassObject (in /usr3/work/mozilla/builds/1.9.1/mozilla/js/src/Linux_All_OPT.OBJ/js)
==4311==    by 0x80936BA: js_GetClassPrototype (in /usr3/work/mozilla/builds/1.9.1/mozilla/js/src/Linux_All_OPT.OBJ/js)
==4311==    by 0x8093957: js_NewObject (in /usr3/work/mozilla/builds/1.9.1/mozilla/js/src/Linux_All_OPT.OBJ/js)
==4311==    by 0x80707CC: js_NewFunction (in /usr3/work/mozilla/builds/1.9.1/mozilla/js/src/Linux_All_OPT.OBJ/js)
==4311==    by 0x8070873: js_DefineFunction (in /usr3/work/mozilla/builds/1.9.1/mozilla/js/src/Linux_All_OPT.OBJ/js)
==4311==    by 0x804ED35: JS_DefineFunction (in /usr3/work/mozilla/builds/1.9.1/mozilla/js/src/Linux_All_OPT.OBJ/js)

Comment 1

[Bob Clary [:bc] (inactive)]

I think this run started before the mc/tm merge. I killed it and started a new one and haven't seen these yet. closing out as wfm.

Comment 2

[Bob Clary [:bc] (inactive)]

js1_5/extensions/regress-454040.js does reproduce with with a fresh pull on mc.

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix

Since source notes are a linked list, it seems like there must always be a terminator note. This is taken care of in the normal path by js_FinishTakingSrcNotes but the special Function.prototype script needs special help. I'm not sure if there's a helper function for this, though.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/be7b0050fe5c

Comment 5

[Bob Clary [:bc] (inactive)]

v 1.9.2

Comment 6

[Bob Clary [:bc] (inactive)]

v 1.9.1