Assertion failure: FUN_FLAT_CLOSURE(callee_fun) / Crash

RESOLVED DUPLICATE of bug 592202

Status

()

Core
JavaScript Engine
--
critical
RESOLVED DUPLICATE of bug 592202
7 years ago
4 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 1 bug, 5 keywords)

Trunk
x86_64
Linux
assertion, crash, regression, reproducible, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite -

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [sg:critical?])

(Reporter)

Description

7 years ago
The following shell testcase:

test();
function test()
{
  var counter = 0;
  function f(x,y) {
      try
      { 
        throw 42;
      }
      catch(e2)
      { 
        foo(function(){ return x; }| "9.2" && 5 || counter && e);
        ++counter;
      }
  }

  f(2, 1);
}

function foo(bar) { return ""+bar; }


causes "Assertion failure: FUN_FLAT_CLOSURE(callee_fun), at jsfun.cpp:1178", tested on mc trunk. In an optimized build it crashes:

==1996== Invalid read of size 8
==1996==    at 0x4643A0: js::GetFlatUpvar(JSContext*, JSObject*, long, js::Value*) (in /scratch/holler/LangFuzz/sources/mozilla-central-hg/js.opt/src/shell/js)
==1996==    by 0x48DE1C: js_GetProperty(JSContext*, JSObject*, JSObject*, long, js::Value*) (in /scratch/holler/LangFuzz/sources/mozilla-central-hg/js.opt/src/shell/js)
==1996==    by 0x5FCD68: js::Interpret(JSContext*, JSStackFrame*, unsigned int, JSInterpMode) (in /scratch/holler/LangFuzz/sources/mozilla-central-hg/js.opt/src/shell/js)
==1996==    by 0x476CF6: js::Execute(JSContext*, JSObject*, JSScript*, JSStackFrame*, unsigned int, js::Value*) (in /scratch/holler/LangFuzz/sources/mozilla-central-hg/js.opt/src/shell/js)
==1996==    by 0x4118F5: JS_ExecuteScript (in /scratch/holler/LangFuzz/sources/mozilla-central-hg/js.opt/src/shell/js)
==1996==    by 0x407850: Process(JSContext*, JSObject*, char*, int) (in /scratch/holler/LangFuzz/sources/mozilla-central-hg/js.opt/src/shell/js)
==1996==    by 0x4085FF: Shell(JSContext*, int, char**, char**) (in /scratch/holler/LangFuzz/sources/mozilla-central-hg/js.opt/src/shell/js)
==1996==    by 0x408904: main (in /scratch/holler/LangFuzz/sources/mozilla-central-hg/js.opt/src/shell/js)
==1996==  Address 0xfff2000000000000 is not stack'd, malloc'd or (recently) free'd

Flagged as security because I didn't have time to inspect the crash further.

Comment 1

7 years ago
Slightly simpler:

function p() { }
function test()
{
  var counter = 0;

  function f(x) {
      try
      { 
        throw 42;
      }
      catch(e)
      { 
        counter;
        p(function(){x;});
        counter = 1;
      }
  }

  f(2);
}
test();

Comment 2

7 years ago
Regression range seems to blame bug 558451.

Dup of bug 592202?

Updated

7 years ago
Blocks: 558451
Keywords: assertion, crash, regression, reproducible, testcase
Whiteboard: [sg:critical?]
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 592202
(Reporter)

Updated

6 years ago
Blocks: 676763
(Reporter)

Comment 4

6 years ago
Fixed for a long time and not affecting old branches (according to duped bug), opening this.
Group: core-security
(Reporter)

Comment 5

4 years ago
A testcase for this bug was already added in the original bug (bug 592202).
Flags: in-testsuite-
You need to log in before you can comment on or make changes to this bug.