674545 - Crash with too complex regular expressions in js1_5/extensions/regress-330569.js and js1_5/extensions/regress-351448.js

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Bob Clary [:bc] (inactive)]

Attachment: 330569 stack

js1_5/extensions/regress-330569.js and js1_5/extensions/regress-351448.js crash browser and shell opt and debug on 1.9.2 Linux 32 and 64 bit at least. Haven't tried others. Regressed around 2011-07-23

Comment 1

[Bob Clary [:bc] (inactive)]

Attachment: 351448 stack

Comment 2

[Bob Clary [:bc] (inactive)]

bug 626297 ?

Comment 3

[Chris Leary [:cdleary] (not checking bugmail)]

Attachment: Initialize res to NULL for cleanup goto.

Missed this because I was using the more modern jstests, which had these tests marked as "skip" because YARR doesn't have the same complexity errors.

Comment 4

[Daniel Veditz [:dveditz]]

Comment on attachment 548919 [details] [diff] [review]
Initialize res to NULL for cleanup goto.

Approved for 1.9.2.20, a=dveditz

Code freeze for 1.9.2.20 is Monday Aug 1, please land soon.

Comment 5

[Daniel Veditz [:dveditz]]

Maybe sg:critical if you can get attacker data left over on the stack where res will be created.

Comment 6

[Chris Leary [:cdleary] (not checking bugmail)]

Bob, do you think you could run this patch against the 1.9.2 test suite to confirm we're good now? js reftests apparently don't run on the 1.9.2 tinderboxen and I don't think I'm using the jsDriver correctly.

Comment 7

[Bob Clary [:bc] (inactive)]

sure. I'll let you know in a while.

Comment 8

[Bob Clary [:bc] (inactive)]

I'm running the full set of tests on 1.9.2 with the patch. The old way I normally do it is to run js shell opt/debug and browser opt/debug without jit and with jit. The browser tests actually start and stop the browser for each test so they don't get hung up or terminate due to a crash but that means it takes forever to run them. So far, non-jit js shell opt/debug and firefox opt have passed with flying colors, but i really would like to complete a bit more. The full results will be in tomorrow and we'll be able to get this in then.

Comment 9

[Bob Clary [:bc] (inactive)]

All tests passed with no regressions.

Comment 10

[Chris Leary [:cdleary] (not checking bugmail)]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/13bbe383ceb2

Comment 11

[Al Billings [:abillings - ex-MoCo]]

Verified fixed in 1.9.2 based on passing tests.