621991 - Assertion failure: FUN_FLAT_CLOSURE(callee_fun) / Crash

Status: RESOLVED DUPLICATE of bug 592202

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following shell testcase:

test();
function test()
{
  var counter = 0;
  function f(x,y) {
      try
      { 
        throw 42;
      }
      catch(e2)
      { 
        foo(function(){ return x; }| "9.2" && 5 || counter && e);
        ++counter;
      }
  }

  f(2, 1);
}

function foo(bar) { return ""+bar; }


causes "Assertion failure: FUN_FLAT_CLOSURE(callee_fun), at jsfun.cpp:1178", tested on mc trunk. In an optimized build it crashes:

==1996== Invalid read of size 8
==1996==    at 0x4643A0: js::GetFlatUpvar(JSContext*, JSObject*, long, js::Value*) (in /scratch/holler/LangFuzz/sources/mozilla-central-hg/js.opt/src/shell/js)
==1996==    by 0x48DE1C: js_GetProperty(JSContext*, JSObject*, JSObject*, long, js::Value*) (in /scratch/holler/LangFuzz/sources/mozilla-central-hg/js.opt/src/shell/js)
==1996==    by 0x5FCD68: js::Interpret(JSContext*, JSStackFrame*, unsigned int, JSInterpMode) (in /scratch/holler/LangFuzz/sources/mozilla-central-hg/js.opt/src/shell/js)
==1996==    by 0x476CF6: js::Execute(JSContext*, JSObject*, JSScript*, JSStackFrame*, unsigned int, js::Value*) (in /scratch/holler/LangFuzz/sources/mozilla-central-hg/js.opt/src/shell/js)
==1996==    by 0x4118F5: JS_ExecuteScript (in /scratch/holler/LangFuzz/sources/mozilla-central-hg/js.opt/src/shell/js)
==1996==    by 0x407850: Process(JSContext*, JSObject*, char*, int) (in /scratch/holler/LangFuzz/sources/mozilla-central-hg/js.opt/src/shell/js)
==1996==    by 0x4085FF: Shell(JSContext*, int, char**, char**) (in /scratch/holler/LangFuzz/sources/mozilla-central-hg/js.opt/src/shell/js)
==1996==    by 0x408904: main (in /scratch/holler/LangFuzz/sources/mozilla-central-hg/js.opt/src/shell/js)
==1996==  Address 0xfff2000000000000 is not stack'd, malloc'd or (recently) free'd

Flagged as security because I didn't have time to inspect the crash further.

Comment 1

[Jesse Ruderman]

Slightly simpler:

function p() { }
function test()
{
  var counter = 0;

  function f(x) {
      try
      { 
        throw 42;
      }
      catch(e)
      { 
        counter;
        p(function(){x;});
        counter = 1;
      }
  }

  f(2);
}
test();

Comment 2

[Jesse Ruderman]

Regression range seems to blame bug 558451.

Dup of bug 592202?

Comment 4

[Christian Holler (:decoder)]

Fixed for a long time and not affecting old branches (according to duped bug), opening this.

Comment 5

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 592202).