544160 - TM: Crash trying to write too many values to a Call object on function return

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[David Mandelin [:dmandelin]]

Attachment: Patch

Spun off from bug 503772 comment 10. 

The problem is that in the tracer, when we flush the values to a Call object on return from a function, if there is an arguments object, we pass argc as the number of argument values to flush. But the function that creates Call objects allocates fun->nargs slots. If the function is called with more arguments than it has formal params, then argc > fun->nargs, and we do an invalid write flushing the values. This corrupts memory, which can lead to crashes in the GC. (The attached test case corrupts memory more, so it crashes right away.)

Comment 1

[David Mandelin [:dmandelin]]

http://hg.mozilla.org/mozilla-central/rev/0f817ba06787