Last Comment Bug 657524 - Audit jsopcode.cpp for use of *pc that doesn't take traps into account
: Audit jsopcode.cpp for use of *pc that doesn't take traps into account
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Mac OS X
: -- critical (vote)
: ---
Assigned To: general
:
:
Mentors:
Depends on:
Blocks: jsfunfuzz
  Show dependency treegraph
 
Reported: 2011-05-16 17:13 PDT by Jesse Ruderman
Modified: 2012-02-02 23:01 PST (History)
6 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Jesse Ruderman 2011-05-16 17:13:38 PDT
I keep hitting non-deterministic assertions in the decompiler when fuzzing with trap(). For example, I've hit all of these on 64-bit Mac:

LOCAL_ASSERT(*pc == JSOP_GOTO || *pc == JSOP_GOTOX);

LOCAL_ASSERT(tail + GetJumpOffset(pc+tail, pc+tail) == pc2 - pc);

LOCAL_ASSERT(sn && SN_TYPE(sn) == SRC_SWITCH);

The testcases tend to involve long functions (>100 bytes of bytecode) and resist reduction or even reproduction.

Brendan thinks the best course is to audit jsopcode.cpp (which includes the decompiler) for uses of *pc that won't do the right thing with traps.  Then I can fuzz more and see if I still hit the yucky non-determinism.
Comment 1 Jeff Walden [:Waldo] (remove +bmo to email) 2012-02-02 21:03:01 PST
Whichever bug and hacker removed js_GetTrapOpcode fixed this for you, methinks.  \o/  Too lazy to search for it, someone else can if they care.
Comment 2 Gary Kwong [:gkw] [:nth10sd] 2012-02-02 23:01:24 PST
> Whichever bug and hacker removed js_GetTrapOpcode fixed this for you,
> methinks.  \o/  Too lazy to search for it, someone else can if they care.

Bug 707454 removed JSOP_TRAP.

Note You need to log in before you can comment on or make changes to this bug.