Last Comment Bug 719674 - JS Crash on heap with invalid memory being executed
: JS Crash on heap with invalid memory being executed
Status: VERIFIED FIXED
[sg:critical] js-triage-needed
: crash, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Linux
: -- critical (vote)
: mozilla12
Assigned To: Brian Hackett (:bhackett)
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: langfuzz 706914
  Show dependency treegraph
 
Reported: 2012-01-19 17:53 PST by Christian Holler (:decoder)
Modified: 2013-03-11 08:22 PDT (History)
5 users (show)
choller: in‑testsuite-
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
unaffected
+
fixed
+
fixed
unaffected


Attachments
shell testcase, unpack, chdir and run main.js with options "-n -m -a" (3.06 KB, application/x-compressed-tar)
2012-01-19 17:53 PST, Christian Holler (:decoder)
no flags Details
shell testcase (dbg), unpack, chdir and run main.js with options "-n -m -a" (2.34 KB, application/x-compressed-tar)
2012-01-20 12:13 PST, Christian Holler (:decoder)
no flags Details
patch (47584f117727) (13.85 KB, patch)
2012-01-23 09:26 PST, Brian Hackett (:bhackett)
dvander: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2012-01-19 17:53:16 PST
Created attachment 590070 [details]
shell testcase, unpack, chdir and run main.js with options "-n -m -a"

The attached test crashes on mozilla-central revision e5e66f40c35b (32 bit opt build, options -m -n -a). The test is one of a few that recently popped up that seem highly fragile while reducing.

GDB Backtrace:

Program received signal SIGSEGV, Segmentation fault.
0xf73cd15a in ?? ()
(gdb) bt
#0  0xf73cd15a in ?? ()
#1  0x08328380 in ?? ()
#2  0x082fbff4 in ?? ()
Backtrace stopped: previous frame inner to this frame (corrupt stack?)
(gdb) x /4i $pc
=> 0xf73cd15a:  Cannot access memory at address 0xf73cd15a

This does not crash in valgrind. S-s and sg:critical due to attempted execution of invalid memory.
Comment 1 Christian Holler (:decoder) 2012-01-20 12:13:28 PST
Created attachment 590283 [details]
shell testcase (dbg), unpack, chdir and run main.js with options "-n -m -a"

Here's another, shorter test that works with the debug shell for better debugging.
Comment 2 Brian Hackett (:bhackett) 2012-01-23 09:26:09 PST
Created attachment 590742 [details] [diff] [review]
patch (47584f117727)

Regression from bug 706914, when stubbing a LookupSwitch or TableSwitch, if the native code for the target was not found then the compartment's entire stack was switched over to the interpreter and execution continued.  This is not valid to do --- ClearAllFrames must be followed by wiping out all JIT code in the compartment, and clearStackReferences must be followed by wiping out all of the script's code.  Updated comments, and went through all uses of these functions to fix any other problems, which turned up issues in recompileForStepMode, and TI-triggered recompilation.
Comment 3 Brian Hackett (:bhackett) 2012-01-23 16:51:13 PST
https://hg.mozilla.org/integration/mozilla-inbound/rev/6c5229914ef9
Comment 4 Brian Hackett (:bhackett) 2012-01-24 05:16:51 PST
https://hg.mozilla.org/mozilla-central/rev/6c5229914ef9

Note You need to log in before you can comment on or make changes to this bug.