563772 - Assertion failed: "((exceptionFrame != __null))" ("/Users/cpeyer/hg/tamarin-redux-security/core/AvmCore.cpp":1014)

Status: RESOLVED FIXED

(Tamarin Graveyard :: Virtual Machine, defect, P2)

Description

[Chris Peyer]

Attachment: fuzzed abc file that throws assert

Found with tr-sec r4276.

Original .abc file is test/acceptance/ecma3/Number/toLocaleString_tr.abc

abcdump diff:
diff -u <(abcdump -abs ./ecma3/Number/toLocaleString_rt.abc) <(abcdump -abs crash_10183_4_6.abc)
--- /dev/fd/63	2010-05-04 13:41:00.000000000 -0700
+++ /dev/fd/62	2010-05-04 13:41:00.000000000 -0700
@@ -1712,7 +1712,8 @@
   1697      setproperty   	{, private, }::<null>
   1699      getscopeobject	0
   1701      findpropstrict	{, private, }::Number
-  1703      pushdouble    	10000000000000000000
+  1703      swap          	
+  1704      throw         	
   1705      constructprop 	{, private, }::Number (1)
   1708      convert_d     	
   1709      setslot       	3

Comment 1

[Chris Peyer]

Attachment: avmplusCrash.dmp

Comment 2

[Steven Johnson]

Although this is a null-pointer dereference, it's specific to avmshell: what's happening is that an error is thrown, and in ShellCore::handleArbitraryExecutableContent() we attempt to print the string of the error to the console... and calling toString() on this method throws, and we have no try/catch block active (since we're in the catch block of the outermost try/catch).

A fix is doable but I think this one can probably be declassified.

Comment 3

[Steven Johnson]

Attachment: Patch

The obvious workaround...

Comment 4

[Edwin Smith]

Comment on attachment 444154 [details] [diff] [review]
Patch

nit: funny indentation.  agree about declassifying.

Comment 5

[Dan Smith]

Declassify, move to 10.2.

Comment 6

[Steven Johnson]

http://hg.mozilla.org/tamarin-redux/rev/1bb703df1493