642022 - "Assertion failure: compartment mismatched" with InstallTrigger.constructor

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Assertion failure: compartment mismatched, at js/src/jscntxtinlines.h:545

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 2

[Jesse Ruderman]

Reproduced with mozilla-central rev 4866be78732f and tracemonkey rev 67b102d581dd.

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Patch

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 519564 [details] [diff] [review]
Patch

oops, wrong bug.

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Real patch

This was the easiest fix.

Comment 6

[Daniel Veditz [:dveditz]]

Is this a compartment-leaking security bug (sg:high or worse), or just an oops? I don't crash in an opt build, is "testcase (crashes Firefox when loaded)" simply a fatal assert in a debug build?

Comment 7

[Andreas Gal :gal]

I think this can cause problems during GC with compartment GCs. Based on that alone I would say sg:something.

Comment 8

[Blake Kaplan (:mrbkap) (inactive)]

From talking to billm on IRC, operating on JS objects in the wrong compartment can cause us to collect reachable objects during GC. That's sg:critical. So, we should probably consider this as [sg:critical?]. Looking at the code, I'm not convinced that this case in particular is actually exploitable at all (and the result of the code that causes the assertion is thrown away anyway) but it's better to be safe than sorry.

Comment 9

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/bed34ea0027c

Comment 10

[Cameron Kaiser [:spectre]]

Per security group discussion, requesting landing on mozilla-2.0.

Comment 11

[Daniel Veditz [:dveditz]]

Comment on attachment 519573 [details] [diff] [review]
Real patch

Approved for the mozilla2.0 repository, a=dveditz for release-drivers