629650 - MethodJIT: Assertion failure: cx->enumerators == obj, at jsiter.cpp:789

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

Attachment: Test case for shell (run with -j and -m)

The attached testcase asserts on 64 bit TM tip, run in shell with "-j -m". Testcase is not minimal and might not terminate if assertion isn't triggered (sorry, didn't have more time for further minimization/rewriting).

Backtrace:

#0  0x00007ffff7bd1ebb in raise () from /lib/libpthread.so.0
#1  0x0000000000598960 in JS_Assert (s=0x736327 "cx->enumerators == obj", file=0x73626b "jsiter.cpp", ln=789) at jsutil.cpp:83
#2  0x00000000004d49e9 in js_CloseIterator (cx=0xae80c0, obj=0x7ffff689a288) at jsiter.cpp:789
#3  0x00000000006b29a5 in FindExceptionHandler (cx=0xae80c0) at ./methodjit/InvokeHelpers.cpp:159
#4  0x00000000006b3b19 in js_InternalThrow (f=...) at ./methodjit/InvokeHelpers.cpp:552
#5  0x000000000064cac8 in JaegerThrowpoline () at ./methodjit/MethodJIT.cpp:139
#6  0x00007ffff7f96400 in ?? ()
[...]

Bisect shows:

Changeset 54650:427282865362: bad
The first bad revision is:
changeset:   54650:427282865362
user:        Bill McCloskey <[e-mail]>
date:        Wed Sep 29 13:21:36 2010 -0700
summary:     Bug 535912 - Eliminate blockChain from JSStackFrame (r=cdleary)

however, this revision shows a different assertion

"Assertion failure: offset < script->length, at ../methodjit/InvokeHelpers.cpp:90"

This did not crash in my tests, so no security lock. Lock if appropriate.

Comment 1

[Andreas Gal :gal]

Similar stacks before were exploitable because the iterator stack becomes unbalanced and the next GC can kill the objects on it.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

The problem is that stubs::FixupArity leaves an incoherent cx->regs->pc when throwing.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Comment 4

[Luke Wagner [:luke]]

Comment on attachment 508298 [details] [diff] [review]
fix

r+ with the testcase.

Comment 5

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/tracemonkey/rev/a7a3317dac32

didn't checkin testcase since it infinite loops

Comment 7

[Chris Leary [:cdleary] (not checking bugmail)]

cdleary-bot mozilla-central merge info:
http://hg.mozilla.org/mozilla-central/rev/a7a3317dac32

Comment 8

[Christian Holler (:decoder)]

Fixed for a long time and not affecting old branches, opening this.

Comment 9

[Raymond Forbes[:rforbes]]

rforbes-bugspam-for-setting-that-bounty-flag-20130719