568855 - Crash [@ nanojit::LIns::opcode] with non-native __proto__

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

this.__proto__ = Proxy.create({has:function(){return false}});
(function(){
  eval("(function(){ for(var j=0;j<6;++j) if(j%2==1) p=0; })")();
})()

Triggers one of the following (all in a debug build):
* Crash [@ nanojit::LIns::opcode]
* Crash [@ nanojit::LirWriter::insImmI]
* Assertion failed: 0 (../nanojit/LIR.cpp:996)
* Assertion failure: status == ARECORD_COMPLETED || status == ARECORD_ABORTED || status == ARECORD_ERROR, at ../jstracer.cpp:7139

The proliferation of assertions and crashes may make this annoying for jsfunfuzz.

Comment 1

[Andreas Gal :gal]

This can be triggered via liveconnect as well, and might affect branches.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

js> this.__proto__ = Proxy.create({has:function(){return false}});
js> (function(){
  eval("(function(){ for(var j=0;j<6;++j) if(j%2==1) p=0; })")();
})()

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x0000003a
0x001601f5 in nanojit::CseFilter::insLoad ()
(gdb) 
(gdb) bt
#0  0x001601f5 in nanojit::CseFilter::insLoad ()
#1  0x0012cd95 in js::TraceRecorder::traverseScopeChain ()
#2  0x00138575 in js::TraceRecorder::record_JSOP_BINDNAME ()
#3  0x00155618 in js::TraceRecorder::monitorRecording ()
#4  0x0005bc76 in js_Interpret ()
#5  0x000665a0 in js_Execute ()
#6  0x0000f67c in JS_ExecuteScript ()
#7  0x00004cfc in Process ()
#8  0x000090ba in main ()
(gdb) x/i $eip
0x1601f5 <_ZN7nanojit9CseFilter7insLoadENS_7LOpcodeEPNS_4LInsEih+629>:  call   *0x30(%ecx)
(gdb) x/b $ecx
0xa:    Cannot access memory at address 0xa

Comment 3

[Andreas Gal :gal]

This is not a recent regression. And it affects branches. Keep this closed please.

Comment 4

[Andreas Gal :gal]

Attachment: patch

Existing bug in js_FindIdentifierBase usage here. It can deep abort. Static analysis would be nice here.

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(This was checked in to TM)

http://hg.mozilla.org/tracemonkey/rev/3e86dbfb0814

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/3e86dbfb0814

Comment 7

[LegNeato]

Any hope for branch patches for this?

Comment 8

[Andreas Gal :gal]

Attachment: patch for 1.9.2

Comment 9

[LegNeato]

Comment on attachment 455263 [details] [diff] [review]
patch for 1.9.2

a=LegNeato for 1.9.2.7. Please land on mozilla-1.9.2 default.

Thanks for getting to this!

Comment 10

[Andreas Gal :gal]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/fb26dff2f09e

Comment 11

[LegNeato]

This affects 1.9.1 as well, yes?

Comment 12

[Andreas Gal :gal]

1.9.1 is not affected. We didn't trace this case back then.

Comment 13

[LegNeato]

Thanks for confirming!

Comment 14

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929