690650 - TI: Crash [@ js_InternalInterpret] or "Assertion failure: codeArray[offset],"

Status: RESOLVED FIXED

Description

[Gary Kwong [:gkw] [:nth10sd]]

Created attachment 563647 [details]
testcase

The attached testcase asserts js debug shell on JM changeset 44ef245b8706 and m-c changeset db9e99d537f2 with -m, -a and -n at Assertion failure: codeArray[offset], and crashes js opt shell at js_InternalInterpret

This was found using a combination of jsfunfuzz and jandem's method fuzzer.

Since it seems to be a null deref, assuming sg:dos and locking s-s to be safe.

Comment 1

[Gary Kwong [:gkw] [:nth10sd]]

Created attachment 563650 [details]
stack

Comment 2

[Brian Hackett (:bhackett)]

Created attachment 565103 [details] [diff] [review]
patch

Use of GET_JUMP_OFFSET which did not watch for JOF_JUMPX opcodes.  No other suspicious uses of GET_JUMP_OFFSET in analysis/compilation code, though I'd kind of like to kill GET_JUMP_OFFSET / GET_JUMP_OFFSETX completely and use a common function to compute offsets for both.

Comment 3

[Brian Hackett (:bhackett)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/cfda40f4a5c8

Comment 4

[Christian Holler (:decoder)]

https://hg.mozilla.org/mozilla-central/rev/cfda40f4a5c8

Comment 5

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929